F4

Ratomir Jovanovic, on GitHub as ratomirjovanovic

Engineering work, kept with its evidence.

I build payment and security tooling. This is where I record what I build, why it is built that way, what broke, and how it was fixed, with links to the commits, issues and tests that show it.

Selected workProblem recordsJournal
Context
6
Decision
5
Implementation
11
Evidence
21
Each mark is one documented item: a constraint, a decision, a piece of implementation, or a link to evidence.

Selected work

Projects with their decisions, limits and sources. One project is published so far; more appear here only once they can be documented the same way.

PandaPayLens

An open-source, local-first toolkit that decodes payment provider errors, webhooks and event logs, rebuilds the transaction timeline and explains what looks wrong, without sending the data anywhere.

When a payment integration misbehaves, the evidence is a pile of provider-specific JSON, XML and webhook deliveries. Reading it means knowing each provider's formats, error codes and delivery habits, and the data is often too sensitive to paste into an online tool.

Read the case study Source Live demo npm
Status
Active
Type
Developer tool
Role
Creator and maintainer
Technology
TypeScript, Next.js, React

Problems solved

Real defects with symptoms, root cause, fix and validation, taken from issues and pull requests. All 6 records

Engineering notes

Longer write-ups of investigations, architecture and tradeoffs.

Open-source activity

Recent public work on GitHub, grouped by repository and day.

Last synced . Not real time. Full activity

Working principles

Each one points to code where it was applied.

  • A green check is not the result

    A finding is only as good as its evidence and stated limits. Duplicate deliveries found by identical content are reported as possible, never confirmed.

    PandaPayLens pull request #50

  • Fail with a typed error, not a stack overflow

    Untrusted input gets explicit limits, linear-time parsing and errors that say what went wrong.

    Safe XML reader, pull request #53

  • Keep sensitive data where it already is

    Payment payloads are analyzed in the browser or on the local machine, and a Content Security Policy blocks requests to other origins.

    PandaPayLens privacy model

  • Same input, same answer

    Timestamps without a time zone are dropped instead of being read in the local zone of whichever machine runs the code.

    Pull request #61

  • Provider state is not financial finality

    An authorization is not a capture and a capture is not settlement. Tools should say what the records show, and nothing more.

    Adapter brief

More

Theme