Максим

Maksym Paliy
.NET Backend Developer · LLM Integration & AI Features
Lviv, Ukraine (remote / hybrid) · [open contact info](look above in the "contact info" section) · github.com/Msk3123 · LinkedIn
SUMMARY
Backend developer on ASP.NET Core who ships LLM features into real products. Three projects live in production: an e-commerce site
with an AI admin assistant for a small business, my own AI tarot product Lunaris, and the BEST Lviv website. I build function calling with
human-in-the-loop and limits enforced in code, not in the prompt, and care about security (IDOR fixes, rate limiting, sanitization). I use
Claude Code daily and review everything I ship.
EXPERIENCE
Backend Developer — Freelance & own products 2025 – Present
Software Engineering Intern — SoftServe 2024 · 3 months
.NET / C# development in a team workflow: Git, code review, task tracking and Agile ceremonies.
PROJECTS
Mamyna Shafa — AI-powered e-commerce for a real small business live site · GitHub
Live shop for a real seller (my mother). Built with AI-assisted development (Claude Code); I owned requirements, architecture decisions,
code review and deployment.
• Backend: .NET 10, Clean Architecture with command/query handlers, Result<T> errors mapped to ProblemDetails, Minimal API
endpoints, EF Core + PostgreSQL with migrations; React + TypeScript + Vite storefront and admin panel.
• LLM integration: admin assistant on OpenAI Chat Completions (raw HTTP behind an IChatModel abstraction) with function calling
over read-only tools, plus human-in-the-loop action tools: the model only prepares changes and the owner confirms them.
• Vision + structured output: "fill from photo" reads the clothing tag and fills the product card via strict JSON schema, marking
uncertain fields; long-term assistant memory; prompt caching and token caps for cost control.
• Production: DigitalOcean VPS, Docker Compose, Caddy (automatic HTTPS), nightly PostgreSQL backups, firewall; cookie auth with
password hash and login rate limiting; secrets outside git.
Tech: .NET 10 · ASP.NET Core Minimal API · EF Core · PostgreSQL · OpenAI API (function calling, vision, JSON schema) · React · TypeScript ·
Docker · Caddy
Lunaris (TaroSide AI) — my own AI tarot product, live live site · GitHub
• LLM via Microsoft.Extensions.AI with function calling: the model must call a tool that draws real cards from a seeded 78-card
PostgreSQL deck, so it never invents cards; system-prompt guardrails.
• Role-based tiers (Guest / Free / Premium / Vip / Admin) with daily message limits; when the quota is spent the tool is not attached
to the request, so the limit cannot be bypassed by prompt injection (HTTP 429).
• Found and fixed an IDOR (BOLA) by enforcing resource ownership on user and conversation endpoints; typed exceptions mapped
to RFC 7807 ProblemDetails; Clean Architecture (.NET 9), Identity + JWT, xUnit tests, React 19 + TypeScript SPA.
Tech: .NET 9 · ASP.NET Core · EF Core 9 · PostgreSQL · Identity · JWT · Microsoft.Extensions.AI · OpenAI · xUnit · React 19 · TypeScript
BEST Lviv website backend — live production API, security rewrite best-lviv.org.ua
• Rewrote the backend of a live organization website (real users) into a layered .NET 8 API on MongoDB, with content synced from
the Notion API and media in MinIO (S3-compatible).
• Hardened it for production: constant-time API-key auth, per-IP rate limiting, HTML sanitization (anti-XSS), SSRF-safe image fetching,
strict CORS, secrets out of source, ProblemDetails errors.
Tech: .NET 8 · ASP.NET Core · MongoDB · MinIO (S3) · Notion API · HtmlSanitizer · Swagger
Other: Lviv Polytechnic schedule Telegram bot (C#: scraping, group search, Excel export) · Hotel Booking System (ASP.NET Core MVC,
EF Core, Docker, Google Cloud SQL)
TECHNICAL SKILLS
Backend: C#, .NET 8/9/10, ASP.NET Core (Web API, Minimal API, MVC), EF Core, ASP.NET Identity, REST, Clean Architecture, CQRS-style
handlers, DI, FluentValidation
AI / LLM: OpenAI API, Microsoft.Extensions.AI, function / tool calling, structured outputs (JSON schema), vision, prompt design &
guardrails, prompt caching, local models (Ollama)
Security: JWT, cookie auth, API keys (constant-time), rate limiting, XSS sanitization, SSRF-safe HTTP, IDOR / BOLA ownership checks,
ProblemDetails
Data & DevOps: PostgreSQL, MS SQL Server, MySQL, MongoDB, MinIO / S3 · Docker, Docker Compose, Caddy, DigitalOcean, Google
Cloud SQL, Git · React, TypeScript
Learning now: RAG with pgvector, Python, n8n
EDUCATION, LANGUAGES & LEADERSHIP
Lviv Polytechnic National University — BSc, Computer Engineering 2023 – 2027
Ukrainian — native · English — B1 (actively improving)
BEST Lviv: Corporate Relations for the Engineering Job Fair (pitched to companies, coordinated partners); HR lead for a team of 11; CTF
event logistics.