VantaBlade / Engineering by McCallum Clarke

Full-Stack &
Applied AI
Engineer.

Product Systems · APIs · Data Pipelines · Integrations · Intelligent Automation

I build complete product systems across interfaces, backend services, data, workflows, integrations, automation, and controlled AI. End-to-end ownership, with particular depth where unreliable inputs and uncertain execution need explicit controls.

I build product interfaces, APIs, data workflows, integrations, and controlled AI — from implementation to reviewed delivery.

The strongest evidence is the VantaBlade product environment, where these capabilities operate together across customer-facing and operational systems.

Built and demonstrated in VantaBlade’s customer and operational products.

Discuss a ProjectView Product Systems
View Full Portfolio ↗
Product system / ownership span
  1. 01
    Product interfaceCustomer workspaces / operator tools
  2. 02
    Typed contractClient and API boundaries
  3. 03
    Backend serviceRules / validation / lifecycle
  4. 04
    Data & persistenceCanonical records / provenance
  5. 05
    Integration + workflowExternal systems / recoverable state
  6. 06
    AI + human controlEvidence / policy / approval

Explicit boundaries. Connected execution.

Level 1 / Strongest integrated evidence

Flagship Product Systems

The VantaBlade products demonstrate these capabilities operating together. Focused public repositories isolate selected patterns for independent inspection.

01 / Flagship systemNext.js · React · TypeScript · Python

Strongest integrated evidence

VantaBlade Workforce Exposure

An authenticated multi-tenant SaaS product that turns employee identity-exposure data into incidents, identity cases, remediation workflows, and reporting.

Employee exposure, identity cases, remediation, and executive reporting in one authenticated workspace.

  • — Authenticated multi-tenant SaaS across customer and operational interfaces
  • — Backend-authoritative entitlement, trial, capacity, and lifecycle rules
  • — Queued scan execution, provider warnings, stable fingerprints, and recovery state
  • — Employee-level incident aggregation and remediation lifecycle
  • — Customer and operator workspaces
  • — Backend-owned access and lifecycle rules
  • — Queued scans with recovery state
View Product →View Engineering Case Study →Case study →
  1. Employee inventory
  2. Exposure scan
  3. Normalized findings
  4. Net-new detection
  5. Incidents
  6. Identity cases
  7. Remediation
  8. Reporting
Inspect system architecture
  1. Employee inventory
  2. Exposure scan
  3. Normalized findings
  4. Net-new detection
  5. Incidents
  6. Identity cases
  7. Remediation
  8. Reporting

Scroll for additional product systems →

Product systemNext.js · FastAPI · Python · HIBP

Integrated evidence

VantaBlade DeepScan

A paid, point-in-time identity-intelligence workflow that turns multi-source evidence into structured risk analysis, remediation guidance, persisted reports, and delivery.

Verified payment, secure intake, one-time exposure analysis, and a prioritized report.

Next.js / FastAPI / Python / HIBP

  • — Heterogeneous provider data fusion across several identifier types
  • — Explicit successful, partial, degraded, and failed result vocabulary
  • — Deterministic scoring and remediation with bounded AI narrative support
  1. Backend-created order
  2. Verified PayPal capture
  3. Expiring intake token
  4. Validated one-time intake
  5. Background execution
  6. Provider boundaries
Inspect system detail
  • — Heterogeneous provider data fusion across several identifier types
  • — Explicit successful, partial, degraded, and failed result vocabulary
  • — Deterministic scoring and remediation with bounded AI narrative support
  1. Backend-created order
  2. Verified PayPal capture
  3. Expiring intake token
  4. Validated one-time intake
  5. Background execution
  6. Provider boundaries
View Product →View Engineering Case Study →Case study →
  1. Backend-created order
  2. Verified PayPal capture
  3. Expiring intake token
  4. Validated one-time intake
  5. Background execution
  6. Provider boundaries
Product systemNext.js · React · FastAPI · HIBP

Integrated evidence

VantaBlade FreeScan

A compact public data product connecting anonymous intake, external-data retrieval, normalized results, generated reporting, delivery, analytics, and a paid-product transition.

A free email breach check with clear results, practical actions, and an optional report.

Next.js / React / FastAPI / HIBP

  • — Anonymous API-backed public product with server-owned provider truth
  • — External-data transformation behind a stable application contract
  • — Clear result, no-known-exposure, error, and downstream CTA states
  1. Public product UI
  2. FastAPI boundary
  3. HIBP retrieval
  4. Normalized result contract
  5. Result-state UI
  6. Report assembly and PDF
Inspect system detail
  • — Anonymous API-backed public product with server-owned provider truth
  • — External-data transformation behind a stable application contract
  • — Clear result, no-known-exposure, error, and downstream CTA states
  1. Public product UI
  2. FastAPI boundary
  3. HIBP retrieval
  4. Normalized result contract
  5. Result-state UI
  6. Report assembly and PDF
View Product →View Engineering Case Study →Case study →
  1. Public product UI
  2. FastAPI boundary
  3. HIBP retrieval
  4. Normalized result contract
  5. Result-state UI
  6. Report assembly and PDF
Browse all Product Systems →

Ways to work together

A clear starting point for the system you need.

Comparing service options? View Engagement Pricing

Engineering thesis

Reliability around uncertain boundaries.

Systems become difficult to trust where outside data, services, asynchronous work, or model output enters. I make those boundaries explicit, testable, and recoverable.

Uncertain input.
Explicit control.

01

External data

Malformed, duplicated, incomplete, or conflicting inputs.

ControlsNormalize · validate · deduplicate · review · preserve provenance

Inspect boundary controls

ControlsNormalize · validate · deduplicate · review · preserve provenance

Inspect the proof →
02

External systems

APIs retry, rate-limit, fail, or resend events.

ControlsIdempotency · signatures · replay handling · explicit conflict state

Inspect boundary controls

ControlsIdempotency · signatures · replay handling · explicit conflict state

Inspect the proof →
03

Async execution

Work repeats, stalls, partially completes, or resumes.

ControlsDurable jobs · leases · retries · recovery · dead-lettering

Inspect boundary controls

ControlsDurable jobs · leases · retries · recovery · dead-lettering

Inspect the proof →
04

Probabilistic AI

Outputs can be uncertain, invalid, or weakly evidenced.

ControlsSchemas · evidence grounding · deterministic policy · human approval

Inspect boundary controls

ControlsSchemas · evidence grounding · deterministic policy · human approval

Inspect the proof →

End-to-end ownership

One product outcome. Every layer it depends on.

Work can start in an existing codebase or span a bounded system from interface through persistence, integrations, and operator controls.

The interface, contract, data model, and execution path are designed together. Failure states and operator decisions are part of the system.

Product system / ownership span
  1. 01
    Product interfaceCustomer workspaces / operator tools
  2. 02
    Typed contractClient and API boundaries
  3. 03
    Backend serviceRules / validation / lifecycle
  4. 04
    Data & persistenceCanonical records / provenance
  5. 05
    Integration + workflowExternal systems / recoverable state
  6. 06
    AI + human controlEvidence / policy / approval

Explicit boundaries. Connected execution.

Inspect end-to-end ownership
Product system / ownership span
  1. 01
    Product interfaceCustomer workspaces / operator tools
  2. 02
    Typed contractClient and API boundaries
  3. 03
    Backend serviceRules / validation / lifecycle
  4. 04
    Data & persistenceCanonical records / provenance
  5. 05
    Integration + workflowExternal systems / recoverable state
  6. 06
    AI + human controlEvidence / policy / approval

Explicit boundaries. Connected execution.

Level 3 / Capability map

Product engineering across six connected domains.

The product systems above demonstrate these capabilities operating together. This map synthesizes that evidence; it is not a standalone self-description.

01

Product & Frontend

Build the product interface and its workflow states, from customer workspaces to operator tools.

  • — Authenticated SaaS interfaces
  • — Stateful workflows, review and approval UIs
  • — Typed frontend/API integration
  • — Responsive implementation and accessibility fundamentals

React / Next.js / TypeScript

Capabilities and technologies
  • — Authenticated SaaS interfaces
  • — Stateful workflows, review and approval UIs
  • — Typed frontend/API integration
  • — Responsive implementation and accessibility fundamentals

React / Next.js / TypeScript

02

Backend & APIs

Shape service boundaries, typed contracts, and explicit job lifecycles around product needs.

  • — REST APIs and authenticated boundaries
  • — Service and workflow decomposition
  • — Structured errors and background workers
  • — Failure-path and edge-case testing

Python / FastAPI / Pydantic

Capabilities and technologies
  • — REST APIs and authenticated boundaries
  • — Service and workflow decomposition
  • — Structured errors and background workers
  • — Failure-path and edge-case testing

Python / FastAPI / Pydantic

03

Data & Reliability

Turn uneven inputs into data that downstream systems can validate, trace, and act on.

  • — Ingestion, canonicalization, and entity matching
  • — Idempotency, deduplication, and conflict handling
  • — Provenance, migrations, and relational modeling
  • — Review and rejection routing

PostgreSQL / Supabase / SQLite / SQL

Capabilities and technologies
  • — Ingestion, canonicalization, and entity matching
  • — Idempotency, deduplication, and conflict handling
  • — Provenance, migrations, and relational modeling
  • — Review and rejection routing

PostgreSQL / Supabase / SQLite / SQL

04

Integrations & SaaS

Connect product systems to external services with explicit authentication and recovery boundaries.

  • — OAuth flows and external HTTP APIs
  • — Webhook intake and event processing
  • — Tenant-scoped authorization patterns
  • — SaaS onboarding and lifecycle workflows

OAuth 2.0 / JWT / Supabase Auth / PostgreSQL RLS

Capabilities and technologies
  • — OAuth flows and external HTTP APIs
  • — Webhook intake and event processing
  • — Tenant-scoped authorization patterns
  • — SaaS onboarding and lifecycle workflows

OAuth 2.0 / JWT / Supabase Auth / PostgreSQL RLS

05

Applied AI

Add model-assisted decisions where evidence, policy, and human control remain explicit.

  • — Structured model output and evidence grounding
  • — Deterministic + LLM hybrid workflows
  • — Confidence and evidence-quality modeling
  • — Approval gates and bounded model authority

OpenAI API / Typed schemas / Human review

Capabilities and technologies
  • — Structured model output and evidence grounding
  • — Deterministic + LLM hybrid workflows
  • — Confidence and evidence-quality modeling
  • — Approval gates and bounded model authority

OpenAI API / Typed schemas / Human review

06

Intelligent Automation

Build stateful automation that can resume, report its progress, and recover from stage failures.

  • — Background and scheduled workflows
  • — Operational controls and review queues
  • — Document, report, and artifact generation
  • — Dependency-aware invalidation and recovery

Workflow state / CSV / reports / FFmpeg workflows

Capabilities and technologies
  • — Background and scheduled workflows
  • — Operational controls and review queues
  • — Document, report, and artifact generation
  • — Dependency-aware invalidation and recovery

Workflow state / CSV / reports / FFmpeg workflows

Level 2 / Inspectable pattern evidence

Focused Public Engineering Proofs

The product systems demonstrate integration and ownership. These repositories isolate recurring reliability, AI-control, integration, and automation patterns so they can be inspected independently.

01 / Public proofData integrity
  1. Provider adapters
  2. Typed validation
  3. Canonicalization
  4. Identity and conflict checks
  5. Accept / review / reject
  6. Transactional persistence

Reliable Data Intake Pipeline

Problem / External data arrives malformed, incomplete, duplicated, or conflicting. Passing it directly into an application makes downstream state difficult to trust.

System / Turns inconsistent provider data into validated, canonical records with explicit outcomes and provenance.

Validate messy input, isolate conflicts, and preserve canonical records with reviewable provenance.

  • — Provider adapters and typed API boundaries
  • — Validation, normalization, and conservative deduplication
  • — Idempotent requests, conflict detection, and provenance

External data arrives malformed, incomplete, duplicated, or conflicting. Passing it directly into an application makes downstream state difficult to trust.

  1. Provider adapters
  2. Typed validation
  3. Canonicalization
  4. Identity and conflict checks
  5. Accept / review / reject
  6. Transactional persistence
Inspect architecture and capabilities
  • — Provider adapters and typed API boundaries
  • — Validation, normalization, and conservative deduplication
  • — Idempotent requests, conflict detection, and provenance

External data arrives malformed, incomplete, duplicated, or conflicting. Passing it directly into an application makes downstream state difficult to trust.

  1. Provider adapters
  2. Typed validation
  3. Canonicalization
  4. Identity and conflict checks
  5. Accept / review / reject
  6. Transactional persistence

Python / FastAPI / Pydantic / SQLite / Offline tests

Read case study →View repository ↗
02 / Public proofBounded authority
  1. Canonical evidence
  2. Constrained model output
  3. Evidence and confidence checks
  4. Deterministic policy
  5. Approval gate
  6. Auditable outcome

Controlled AI Decision Pipeline

Problem / Model output can be uncertain, malformed, or weakly supported. A product needs clear limits on what a model can recommend and what requires human review.

System / Combines evidence-grounded model recommendations with deterministic authority rules and human approval.

Constrain AI decisions with checked schemas, evidence, deterministic policy, and human review.

  • — Schema-constrained and evidence-grounded outputs
  • — Evidence quality, confidence, and provenance modeling
  • — Deterministic authority policy and safe-action allowlists

Model output can be uncertain, malformed, or weakly supported. A product needs clear limits on what a model can recommend and what requires human review.

  1. Canonical evidence
  2. Constrained model output
  3. Evidence and confidence checks
  4. Deterministic policy
  5. Approval gate
  6. Auditable outcome
Inspect architecture and capabilities
  • — Schema-constrained and evidence-grounded outputs
  • — Evidence quality, confidence, and provenance modeling
  • — Deterministic authority policy and safe-action allowlists

Model output can be uncertain, malformed, or weakly supported. A product needs clear limits on what a model can recommend and what requires human review.

  1. Canonical evidence
  2. Constrained model output
  3. Evidence and confidence checks
  4. Deterministic policy
  5. Approval gate
  6. Auditable outcome

Applied AI / OpenAI optional / Typed schemas / Human review / Offline execution

Read case study →View repository ↗
03 / Public proofRecoverable execution
  1. Verify signed event
  2. Persist event and job
  3. Acknowledge intake
  4. Claim leased work
  5. Retry or recover
  6. Dead-letter and audit

Reliable Webhook Workflow

Problem / Third-party events can be duplicated, delayed, malformed, or delivered while workers fail partway through processing.

System / Persists signed webhook work quickly, then processes it asynchronously with retries and recovery.

Verify and deduplicate events, then recover durable jobs through retries and partial failures.

  • — HMAC signature verification and strict event validation
  • — Duplicate-safe intake and conflict semantics
  • — Leased worker claims, retries, and stale-work recovery

Third-party events can be duplicated, delayed, malformed, or delivered while workers fail partway through processing.

  1. Verify signed event
  2. Persist event and job
  3. Acknowledge intake
  4. Claim leased work
  5. Retry or recover
  6. Dead-letter and audit
Inspect architecture and capabilities
  • — HMAC signature verification and strict event validation
  • — Duplicate-safe intake and conflict semantics
  • — Leased worker claims, retries, and stale-work recovery

Third-party events can be duplicated, delayed, malformed, or delivered while workers fail partway through processing.

  1. Verify signed event
  2. Persist event and job
  3. Acknowledge intake
  4. Claim leased work
  5. Retry or recover
  6. Dead-letter and audit

Webhooks / Background jobs / Retries / Leases / At-least-once

Read case study →View repository ↗
04 / Public proofArtifact lineage
  1. Adapt and normalize sources
  2. Filter and deduplicate
  3. Generate structured artifacts
  4. Validate stage dependencies
  5. Resume or invalidate
  6. Package outputs

Signal-to-Content Automation Pipeline

Problem / Multi-stage automation can repeat expensive work, lose lineage, or leave stale downstream artifacts after an upstream change.

System / Transforms source material into downstream artifacts through resumable, integrity-checked workflow stages.

Turn source signals into reviewable content artifacts with traceable lineage.

  • — Source adapters and deterministic normalization
  • — Stage dependencies, fingerprints, and cache validation
  • — Artifact provenance, integrity checks, and resumability

Multi-stage automation can repeat expensive work, lose lineage, or leave stale downstream artifacts after an upstream change.

  1. Adapt and normalize sources
  2. Filter and deduplicate
  3. Generate structured artifacts
  4. Validate stage dependencies
  5. Resume or invalidate
  6. Package outputs
Inspect architecture and capabilities
  • — Source adapters and deterministic normalization
  • — Stage dependencies, fingerprints, and cache validation
  • — Artifact provenance, integrity checks, and resumability

Multi-stage automation can repeat expensive work, lose lineage, or leave stale downstream artifacts after an upstream change.

  1. Adapt and normalize sources
  2. Filter and deduplicate
  3. Generate structured artifacts
  4. Validate stage dependencies
  5. Resume or invalidate
  6. Package outputs

Automation / Workflow state / Provenance / FFmpeg optional / Offline execution

Read case study →View repository ↗

Process

From problem to reviewed delivery.

  1. 01

    Share the problem

    Describe the product outcome, current system, constraints, and known failure modes.

  2. 02

    Define the scope

    Agree on deliverables, exclusions, acceptance criteria, timeline, and price.

  3. 03

    Build and validate

    Implement across the relevant layers and check expected paths and failure states.

  4. 04

    Review and handoff

    Walk through the result and provide the agreed notes, code, and follow-up.

FAQ

Questions before we scope the work.

What kinds of systems can you build?

Product features, APIs, data workflows, SaaS integrations, internal tools, operational automation, and controlled AI-assisted workflows.

Can you work inside an existing codebase?

Yes. Work can begin with an existing repository and a bounded repair, feature, integration, or system scope.

Can you own a feature across frontend and backend?

Yes. The work can span a responsive product interface, typed API contracts, service logic, persistence, and workflow states.

Do you build AI-enabled systems?

Yes. Applied AI work can use structured outputs, evidence-aware policies, explicit authority limits, and human approval where appropriate.

How do you handle scope or payment?

The deliverables, boundaries, timeline, and payment schedule are agreed before work begins. Material scope changes are documented and quoted before proceeding.

Can you work with international clients?

Remote international engagements are welcome where contracting and payment arrangements are compatible.

VANTABLADE / NEXT ACTION

Bring the system problem. Leave with a defined engineering scope.

Discuss a product feature, integration, workflow, repair, or applied AI capability with McCallum Clarke.

Discuss a Project
Engineering Portfolio ↗Focused Public ProofsLinkedIn ↗