Chukwunedum Davidson

Senior QA, Security & Software Engineer in Lagos. Five of my seven engineering years in quality and security, lately mostly testing AI output: golden sets, precision and recall, cited sources, and release gates on prompt and model changes. Public credit for 2 CVEs and 3 GitHub Security Advisories.

One reused JWT secret became SUPERADMIN on a payments SaaS.

A single secret signed six unrelated token purposes with no audience claim, and the auth middleware trusted claims without re-resolving the user. A free account could forge SUPERADMIN. Separately, the crypto-payment webhook accepted attacker-chosen fields and granted unlimited lifetime upgrades.

Root-caused to purpose-bound tokens, key separation, and payment-callback binding, not a point patch. The maintainers shipped the fix in 55 minutes. Read the Postiz writeup

Advisory
CVE-2026-48781
Severity
Critical
Public advisories
3
Time to fix
55 min
Start a conversation

Results

Each figure sits beside the baseline it replaced and the system that produced it.

Result Before After Measured on
Repeat regression time 8 h 2 h Shipped With Bugs research suite
Full regression time 2 days 7 h Africa Tech Policy Tracker, 13 services
Field-defect reproduction, average 2 days < 4 h DataFlex, 35 enterprise escalations
Repeated defect patterns baseline −29% Springboard, three delivery cycles
Releases approved with a known blocker open 0 Africa Tech Policy Tracker, 19 deployments

History

  1. Apr 2026 to present

    Independent Senior QA Engineer & Product Security Researcher

    Shipped With Bugs, independent

    Risk-based testing of production B2B SaaS across authentication, billing, permissions, integrations, APIs, and tenant data boundaries. Findings go from reproduction to remediation to verified closure.

    workflows mapped
    31
    test scenarios
    79
    automated checks
    45
    escaped defects captured
    15

  2. Jan 2026 to present

    Senior QA & Release Engineer, Founding Engineer

    Tech Policy Advisory, part-time, remote

    Own quality strategy and release confidence for the Africa Tech Policy Tracker: React and Next.js journeys, REST APIs, asynchronous ingestion, PostgreSQL records, and dashboard data.

    requirements
    29
    risk-based scenarios
    67
    automated checks
    43
    monthly users
    2,517

  3. Sep 2023 to Jan 2026

    Senior QA & Cybersecurity Engineer

    DataFlex Nigeria, Lagos

    Validated enterprise product ecosystems and turned complex field failures into fast engineering evidence by standardising logs, environment data, prerequisites, and Jira-ready reports.

    product ecosystems
    4
    customer environments
    21
    escalations
    35

  4. May 2022 to Sep 2024

    Quality Engineer & Lead QA Mentor

    Springboard, remote, United States

    Set review and deployment standards for a nine-engineer cohort, moving negative, boundary, and failure-path testing earlier into design and code review.

    pull requests reviewed
    157
    releases quality-gated
    81
    engineers
    9

  5. Jul 2019 to Jul 2022

    Software QA Engineer

    AppSwift, Nigeria

    Grew from intern to lead-level quality ownership across web and mobile products.

    products
    7
    production releases
    35
    test scenarios
    149
    reproducible defects
    197

Built and run

I test better because I ship too. These are products I built and operate.

  • Grounded Extraction QA

    QA harness for AI that extracts figures from financial statements. Golden-set precision and recall across six labelled statements, every value must quote its source line, and a CI release gate fails any prompt or model change that makes a field worse. 343 pytest tests.

    Python, FastAPI, pytest, Postman, SQL, LLM APIs

  • Africa Tech Policy Tracker

    Thirteen services that turn policy documents across African jurisdictions into structured intelligence, with extraction evals, dashboards, and deployment automation.

    Next.js, Node.js, Python, PostgreSQL, Docker, Cloudflare

  • Shipped With Bugs

    Independent quality and product security research on production B2B SaaS, published as reproducible writeups.

    Playwright, Python, Postman, SQL

  • BetSignal

    Football value-betting platform on a self-calibrating Poisson model, with model monitoring, automated result resolution, and probabilistic data validation.

    FastAPI, SQLite, Telegram, Prometheus, Grafana

  • PrepCall

    Presales research agent that turns prospect signals into call-prep briefs for a non-technical team, removing about two hours of manual research per call.

    Claude, workflow automation

  • Clicky for macOS

    Screen-aware desktop companion with vision, pointer overlays, streaming transcription, and a multi-provider voice loop.

    Swift, ScreenCaptureKit, TypeScript, Cloudflare Workers

Methods

Test strategy
Risk-based planning, acceptance criteria, test-data design, exploratory and destructive testing, UAT, smoke, regression, boundary and negative paths, BDD scenarios.
Automation
Playwright, Cypress, Selenium, Appium, TypeScript, Java, Python and pytest, reusable fixtures and mocks.
API and data
Postman, direct HTTP probes, SQL and PostgreSQL, contract and schema checks, async workflows, event consistency.
AI evaluation
Golden datasets, precision, recall and grounded recall, hallucination and fabricated-citation detection, regression gating on prompt and model changes.
Release
CI/CD quality gates, GitHub Actions, Docker, Linux, go/no-go calls, production smoke tests, Grafana, release sign-off.
Product security
Authorization, OAuth, multi-tenant isolation, billing state, SSRF, CORS, race conditions, responsible disclosure, remediation verification.
Engineering
React, Next.js, TypeScript, Node.js, Python, Django, FastAPI. Enough product engineering to debug across boundaries.

Next step

Open to senior QA, SDET, test automation, release quality, and product security roles. Remote or hybrid, B2B SaaS and platform teams.

English C1, German A2. Used to distributed teams across time zones.