I’m a security-focused full-stack developer and systems integration specialist based in South Africa.
I build practical web applications, e-commerce platforms, business systems, and secure digital products.
I contribute tested improvements to public software projects, working across unfamiliar codebases, automated testing, documentation, CI and technical review.
My recent contribution work demonstrates the ability to:
- investigate existing architecture and project conventions;
- implement focused fixes without unnecessary scope expansion;
- write regression tests and validation checks;
- work with Python and JavaScript/TypeScript project tooling;
- use Git branches, forks and pull requests safely;
- respond constructively to technical review feedback;
- diagnose edge cases and refine an implementation;
- deliver changes that pass real project CI pipelines.
Only merged upstream contributions are listed here.
| Project | Contribution | Merged PR |
|---|---|---|
| PostHog | Added reuseAnonymousId support to the browser SDK’s identify() flow while preserving backwards compatibility, updating feature-flag identity handoff and adding focused unit, functional and public-API regression coverage. |
#4774 |
| Quittance | Made invoice cancellation/payment settlement ordering deterministic, using trusted ledger close time to resolve races and carrying settlement semantics through memory/Postgres storage, verification, cutover and proof surfaces. | #422 |
| vixcpp/db | Added SQLite migration SQL generation in C++, including portable DDL mapping, deterministic migration output, unsupported-operation diagnostics and executable validation against real SQLite databases. | #2 |
| Stenion | Built current-registry CSV/JSON export end-to-end: persisted PostgreSQL-backed API semantics, deterministic downloads and registry UI controls validated across desktop and mobile flows. | #139, #143 |
| Tapflow | Reduced the dashboard’s largest production JavaScript chunk by ~47%, added independent compressed/raw bundle regression guards, and extended multi-architecture Docker CI to runtime smoke-test the built relay images. | #520, #525, #565 |
| Hardwood | Added independent Parquet interoperability regression coverage proving raw column_orders metadata survives the wire format and is interpreted correctly by parquet-java, including mutation-based validation. |
#1050 |
| Plumbline | Added a Go static-analysis rule for missing authored Soroban contractmeta! metadata, deliberately narrowing detection to avoid multi-file false positives and validating against official SDK behaviour. |
#27 |
| Agent Trust | Added a genuine multi-process SQLite concurrency regression proving exactly one contender can release an escrow and that settlement/review side effects occur exactly once. | #12 |
| NexusMem | Added true end-to-end MCP stdio regression coverage through the built CLI, validating JSON-RPC integrity, local BM25 fallback and detection of protocol-breaking stdout contamination. | #9 |
These contributions complement my broader experience in software delivery, systems integration, QA and release governance, cybersecurity, telecommunications and technical leadership.
Mzansi Select is a South African e-commerce storefront project focused on creating a clean, trustworthy online shopping experience for curated products.
Skills shown: Shopify, e-commerce, storefront UX, product catalogue planning, QA, release control, customer-facing copy.
V-Property is a property/rental platform project focused on helping users browse, manage, and work with property-related information through a web application.
Skills shown: full-stack development, database-backed apps, product delivery, Git workflow, deployment planning, stakeholder preview readiness.
- Full-stack web application development
- Secure-by-design development
- QA-aware engineering
- Business systems and API integration
- E-commerce and product platforms
- Cybersecurity learning and authorised security research
I also practise authorised security research through bug bounty and vulnerability disclosure programmes.
My current focus areas include:
- OWASP Top 10 awareness
- access-control review
- IDOR/BOLA methodology
- information-disclosure analysis
- scope validation
- low-noise testing
- evidence minimisation
- clear vulnerability reporting
Some reports have been accepted or closed as informational, which I treat as learning evidence rather than confirmed high-impact findings.
Private programme details, report contents, target names, screenshots, request/response data, and reproduction material are not published unless disclosure is explicitly approved.
This profile only includes public, recruiter-safe project summaries. Private client work, security research evidence, credentials, supplier details, and confidential project material are intentionally excluded.
I’m open to software development, full-stack, QA-aware engineering, systems integration, and security-focused development opportunities.
- Email: Fhatuwani.Sikhwari@sikhwarigroup.co.za
- GitHub: github.com/Fhatu12
- LinkedIn: linkedin.com/in/fhatuwani-sikhwari-60013a1a
- Website: sikhwarigroup.co.za
Built by SG Digital | A division of Sikhwari Group (Pty) Ltd