Gabriel Bertolassi Barretta · nyxxbit

Founder of Askar Apps  ·  Full-stack engineer  ·  Based in Brazil 🇧🇷

I design, build, and run a multi-tenant SaaS on my own: backend, frontend, bot, infrastructure, payments, and security. Most of my time goes into scaling Askar Apps and growing Ruby Verse, the first store built on it. When I'm not shipping product I do offensive security work, mostly web application pentests and .NET reverse engineering.

const gabriel = {
  name:      "Gabriel Bertolassi Barretta",
  role:      "Founder & Full-Stack Engineer",
  company:   "Askar Apps",
  focus:     ["Distributed Systems", "SaaS Architecture", "Payment Infrastructure", "AppSec & Reverse Engineering"],
  stack:     ["TypeScript", "Node.js", "Next.js", "Discord.js", "MongoDB", "Redis", "BullMQ"],
  currently: "Scaling Askar Apps: dashboard, bot, and Askar Pay",
  location:  "Brazil 🇧🇷",
};

A multi-tenant SaaS for Discord-based Roblox commerce. Store owners run, customize, and scale their Discord shop from a single dashboard, with real-time sync, a native PIX wallet (Askar Pay), and a full affiliate system.

Architecture

• Backend: Express + TypeScript + Mongoose + Redis + Socket.IO + BullMQ + Zod
• Frontend: Next.js + React + TypeScript + Styled-Components + React Query
• Bot: Discord.js + Mongoose + Express + @napi-rs/canvas
• Infra: SquareCloud, MongoDB (multi-tenant), Redis, Blob storage
• Payments: Askar Pay, the platform's native PIX wallet (balance, KYC, withdrawals, commissions)

Highlights

💎 Ruby Verse Premium Robux and Gamepass marketplace, the first store running on Askar Apps.

🛰️ Orion Discord Quest auto-completer built by reverse engineering the client's undocumented webpack internals. A resilient module loader that survives Discord updates, shipped from one codebase as both a userscript and a Vencord plugin. Handles all five quest types, including achievement-in-activity.

Offensive security on the side: web apps, REST and GraphQL APIs, .NET reverse engineering, license and auth bypass, and full white-box engagements. Reports follow a wave-based methodology with PoCs, attack chains, and anti-findings.

• Web application pentesting: OWASP Top 10 applied, auth flows, payment and business-logic bypass, IDOR, XSS (stored/reflected/DOM), CSRF, CORS/CSP, rate limiting, WebSocket security
• API security: REST and GraphQL endpoint enumeration, JWT analysis (alg confusion, secret brute, replay), NoSQL/SQL injection, mass assignment, broken access control
• .NET reverse engineering: dnlib static analysis, Harmony runtime patching, single-file bundle unpack, ConfuserEx/Themida bypass, anti-debug and anti-VM evasion
• License and auth bypass: KeyAuth crack methodology, Ed25519 native-patch, JWT forge, session storage analysis, full NoAuth builds
• Supply chain audit: auto-update mechanism analysis, signature verification gaps, dependency injection vectors

Every engagement runs the same wave structure:

1. Recon: stack mapping, endpoint enumeration via OPTIONS, source and binary extraction
2. Auth + license: flow audit, token analysis, brute force where viable
3. Business logic: core feature audit (cheat logic, payments, RBAC, and so on)
4. Infra + compliance: backend analysis, LGPD/GDPR audit, supply chain
5. Retest + attack chains: end-to-end exploitation PoCs after fixes ship

Deliverable: RELATORIO.pdf with an executive summary, the full findings catalog (CRIT down to INFO), anti-findings (defenses that held), attack chains, and recommended fixes.

Worked with me before, even on a short engagement? A short public note (a LinkedIn comment, a Discord testimonial, a GitHub thank-you) goes a long way, and I take on new audits. Contacts are below.

Discord