Gabriel Bertolassi Barretta — nyxxbit

Founder of Askar Apps  ·  Full-stack engineer  ·  Based in Brazil 🇧🇷

I design, build, and operate a multi-tenant SaaS end to end — backend, frontend, bot, infrastructure, payments, and security. I care about shipping resilient systems, clean architecture, and interfaces that feel premium. Currently focused on scaling Askar Apps and growing Ruby Verse, the first store running on the platform.

const gabriel = {
  name:      "Gabriel Bertolassi Barretta",
  role:      "Founder & Full-Stack Engineer",
  company:   "Askar Apps",
  focus:     ["Distributed Systems", "SaaS Architecture", "Payment Infrastructure", "DX & UI Craft"],
  stack:     ["TypeScript", "Node.js", "Next.js", "Discord.js", "MongoDB", "Redis", "BullMQ"],
  currently: "Scaling Askar Apps — dashboard, bot, and Askar Pay for Discord commerce",
  location:  "Brazil 🇧🇷",
};

SaaS platform for Discord-based Roblox commerce. A multi-tenant dashboard and bot source that lets store owners run, customize, and scale their Discord shop — with real-time sync, a native PIX wallet (Askar Pay), and a full affiliate system.

Architecture

• Backend — Express + TypeScript + Mongoose + Redis + Socket.IO + BullMQ + Zod
• Frontend — Next.js + React + TypeScript + Styled-Components + React Query
• Bot — Discord.js + Mongoose + Express + @napi-rs/canvas
• Infra — SquareCloud, MongoDB (multi-tenant), Redis, Blob storage
• Payments — Askar Pay, the platform's native PIX wallet (balance, KYC, withdrawals, commissions)

Highlights

💎 Ruby Verse Premium Robux & Gamepass marketplace — the first store running on Askar Apps.

🔪 Morrow's Grill Solo horror game built in Roblox Studio. First-person, task-based, no combat. Atmosphere-driven terror in an abandoned 80s restaurant.

Offensive security work on the side — web apps, REST/GraphQL APIs, .NET reverse engineering, license/auth bypass, and full white-box engagements. Reports follow a wave-based methodology with PoCs, attack chains, and anti-findings.

• Web application pentesting — OWASP Top 10 applied, auth flows, payment/business-logic bypass, IDOR, XSS (stored/reflected/DOM), CSRF, CORS/CSP, rate limiting, WebSocket security
• API security — REST/GraphQL endpoint enumeration, JWT analysis (alg confusion, secret brute, replay), NoSQL/SQL injection, mass assignment, broken access control
• .NET reverse engineering — dnlib static analysis, Harmony runtime patching, single-file bundle unpack, ConfuserEx/Themida bypass, anti-debug/anti-VM evasion
• License & auth bypass — KeyAuth crack methodology, Ed25519 native-patch, JWT forge, session storage analysis, full NoAuth builds
• Supply chain audit — auto-update mechanism analysis, signature verification gaps, dependency injection vectors

Each engagement follows the same wave-based structure:

1. W1 — Recon: stack mapping, endpoint enumeration via OPTIONS, source/binary extraction
2. W2 — Auth + license: flow audit, token analysis, brute force where viable
3. W3 — Business logic: core feature audit (cheat logic, payment, RBAC, etc)
4. W4 — Infra + compliance: backend analysis, LGPD/GDPR audit, supply chain
5. Retest + attack chains: end-to-end exploitation PoCs (after fixes shipped)

Deliverable: RELATORIO.pdf with executive summary, full findings catalog (CRIT → INFO), anti-findings (defenses that worked), attack chains, and recommended fixes. Format: light pentest professional with severity color coding.

If we've worked together — even a short engagement — a quick public note (LinkedIn comment, Discord testimonial, GitHub issue thank-you, anything) would mean a lot. Reach out on the contacts below if you'd like to leave one or hire for an audit.

Discord

"Build systems you'd trust your own business to run on — because mine does."