Get in touch

Open to full-time SQA / SDET rolesDhaka

Mahmud Hasan Mubin

SQA Engineer · Test Automation & Systems Verification

Full-Stack Developer · Node.js, NestJS, React & PostgreSQL

I make sure software works before users touch it: Playwright automation, API contract testing and database-level verification across web, mobile and browser extensions — backed by hands-on full-stack development with Node.js, NestJS and React.

View projects Get in touch

1+ yr

Professional SQA

At Avian BPO & IT since May 2025

7+

Company projects tested

Web, Android, iOS and browser extensions

15+

A/B variants validated

Telemetry, routing and analytics events

6+

Open-source dev projects

Node.js, NestJS and React backends and apps

01About

About me

Role
SQA Engineer
Company
Avian BPO & IT
Since
May 2025
Education
B.Sc. CSE, BUBT
Based in
Dhaka, Bangladesh
Open to
Full-time SQA / SDET roles

I'm a Computer Science graduate who started out building full-stack applications with Node.js, NestJS and React. Today I work as an SQA Engineer, and that developer background is my edge: I read the API response, the token and the database row, not just the screen.

I automate end-to-end journeys with Playwright, guard API contracts with Postman and Newman, and verify data integrity directly in PostgreSQL and MongoDB — across web apps, Android and iOS clients, and browser extensions. When a test fails, I isolate the cause down to the payload before it reaches a developer.

I also own the QA process: I lead a 7-member testing team, standardised how bugs are triaged, write the test strategy documents and enforce Definition of Done gates before anything reaches production.

I buildI verify
REST APIs with Node.js, Express and NestJSPostman and Newman API contract tests
React and Next.js interfacesPlaywright E2E suites built on Page Objects
PostgreSQL and MongoDB data modelsDatabase state and ACID transaction checks
JWT authentication and role-based accessJWT, RBAC and IDOR security testing

How I test

01

Architecture-first verification

I test failure modes, distributed state and network boundaries rather than walking the happy path and calling it done.

02

Contract and schema gating

Strict JSON Schema validation on every response, so a breaking backend change is caught before it reaches the UI.

03

Flake-free automation

Auto-waiting locators, isolated storage contexts and reproducible fixtures instead of arbitrary sleeps.

Currently learningRustKubernetesPerformance & load testing (k6)

02Experience

Experience & education

Where I practise quality engineering day to day, and where the engineering foundation came from.

May 2025 – Present

Current role

SQA Engineer

Avian BPO & IT · Dhaka, Bangladesh

  • Automated regression architecture

    Designed and deployed modular regression suites in Playwright (TypeScript) built on Page Object Models, cutting repetitive manual smoke and regression cycles across web platforms.

  • API contract and schema testing

    Engineered Postman collections with dynamic environment variables, pre-request auth scripts, response-time checks and JSON Schema assertions that stop breaking contract changes before release.

  • Backend data verification

    Wrote direct SQL and NoSQL queries against PostgreSQL and MongoDB to validate transactional persistence, foreign-key cascades and rollback states after API mutations.

  • Root cause analysis

    Triaged high-severity bugs through Chrome DevTools network payloads, server error logs and JWT signature inspection, accelerating engineering turnaround on production issues.

  • QA process ownership

    Directed QA operations across a 7-member testing team: standardised bug-triage workflows, authored test strategy documents and enforced Definition of Done criteria for production releases.

  • Experimentation auditing

    Validated 15+ concurrent A/B experiment variants, auditing client telemetry, routing logic and analytics event firing to guarantee experiment data integrity.

  • Playwright
  • TypeScript
  • Postman
  • Newman
  • PostgreSQL
  • MongoDB
  • Jira

Education

B.Sc. in Computer Science & Engineering

Bangladesh University of Business & Technology (BUBT) · Dhaka, Bangladesh

CourseworkData Structures & Algorithms, Database Systems, Computer Networks, Software Engineering, Object-Oriented Analysis & Design

03Skills

Skills & expertise

The tools I test with, and the stack I build with. Testing and automation come first, because that is where I spend most of my day.

017 tools

Test Automation

How I keep regression cycles off the manual backlog

  • Playwright
  • Page Object Model
  • TypeScript
  • Playwright API
  • Newman CLI
  • Jest
  • Pactum
026 skills

API & Protocols

The contracts I hold services to

  • REST APIs
  • WebSockets
  • Postman
  • JSON Schema contracts
  • HTTP / HTTPS
  • cURL
036 skills

Security & Auth QA

Where authorisation boundaries get pushed

  • JWT claims, signature & expiry
  • RBAC boundary matrices
  • TOTP (RFC 6238)
  • Session invalidation
  • BOLA / IDOR checks
  • XSS & SQLi input probing
046 skills

Databases

Where I verify that the data is actually right

  • PostgreSQL
  • MongoDB
  • Complex SQL joins
  • Aggregation pipelines
  • ACID verification
  • Referential integrity
055 skills

Mobile & Cross-Platform

Clients beyond the browser tab

  • Android & iOS real devices
  • Emulators & simulators
  • Chromium & Firefox extensions
  • Biometrics & secure storage
  • FCM / APNs push
066 skills

Performance & Triage

How a vague bug report becomes a root cause

  • Chrome DevTools
  • Core Web Vitals
  • Network payload inspection
  • Server log analysis
  • JMeter (basics)
  • Root cause analysis
076 skills

Backend

What I build, and can read the source of

  • Node.js
  • Express.js
  • NestJS
  • TypeScript
  • Socket.io
  • Prisma
085 skills

Frontend

Interfaces I build and automate

  • React
  • Next.js
  • JavaScript (ES6+)
  • Tailwind CSS
  • HTML5 & CSS3
097 skills

Process & Tools

How the work gets organised and shipped

  • Agile / Scrum
  • Jira
  • Git & GitHub
  • Docker
  • Boundary value analysis
  • State transition testing
  • DoR / DoD gates

04Projects

Built by me. Tested by me.

Company work · SQA expertise

Quality engineering on production platforms

Case studies from the platforms I test at work, described without internal details, code or screenshots.

QA case studyConfidential

Secure Cloud Password Manager

Android · Web vault · Chromium & Firefox extensions

Security QA across zero-knowledge encryption, MFA and cross-platform sync. I found a critical session defect: changing the master password ended the local session but left active JWTs valid on secondary devices, which drove a centralised token revocation mechanism on the backend.

  • zero-knowledge handshake and local vault decryption
  • master-password hashing and MFA flows
  • autofill, vault lock and session timeout on both engines
  • biometric unlock, screenshot blocking, clipboard auto-clear
  • stale JWT on other devices after password changereported → fixed
  • Playwright
  • JWT
  • MFA
  • Android BiometricPrompt
  • Chromium & Firefox
QA case studyConfidential

VMP Messenger

Android · iOS · Responsive web

Social platform with real-time chat. I verified WebSocket message states (sent → delivered → read), delivery receipts and sequence ordering, then simulated packet loss to confirm queued messages resend on reconnect without duplicates or reordering. Also covered infinite-scroll feeds under concurrency, chunked media uploads on 2G/3G, and push delivery through FCM and APNs.

  • WebSockets
  • Playwright
  • Chrome DevTools
  • FCM / APNs
  • Network throttling
QA case studyConfidential

Cross-Platform VPN

iOS · Android · Browser extension

Low-level network failsafe testing: kill-switch activation on abrupt disconnects with zero plaintext IP or DNS leaks, tunnel stability across Wi-Fi to mobile-data handovers and wake-from-sleep, plus WebRTC leak prevention and PAC script execution in the extension. My A/B funnel validation supported a measured 1.2% uplift in referrals.

  • Kill-switch testing
  • DNS / IP leak checks
  • WebRTC
  • PAC scripts
  • A/B validation
QA case studyConfidential

Two-Factor Authenticator App

iOS · Android

Verified 6-digit TOTP generation against RFC 6238 across SHA-1 and SHA-256, including clock-drift tolerance inside the ±30 second step window. Covered QR and manual key ingestion with malformed otpauth:// secrets, confirmed seeds were held in Android KeyStore and iOS Keychain rather than extractable storage, and enforced biometric app lock on resume.

  • TOTP (RFC 6238)
  • Android KeyStore
  • iOS Keychain
  • Biometrics
  • QR parsing
QA case studyConfidential

Project Management Platform

Web application

In-house Kanban and Scrum tooling. I mapped the task lifecycle as a state machine (Backlog → In Progress → In Review → Done) and proved invalid transitions were rejected, validated permission matrices across Admin, Project Manager, Team Lead and Contributor, and checked concurrent board edits for race conditions and stale state.

  • RBAC matrices
  • State transition testing
  • Real-time sync
  • File upload QA
QA case studyConfidential

HR & Payroll Platform

Web application

Financial-precision testing on payroll: boundary value analysis and equivalence partitioning over gross pay, tax deductions, unpaid leave and prorated salaries with no floating-point drift. I also verified multi-tier approval hierarchies against self-approval and bypass attempts, and wrote SQL to confirm every change wrote an immutable audit row.

  • BVA / EP
  • PostgreSQL
  • SQL audit queries
  • Approval workflows
QA case studyConfidential

Marketing & Product Websites

Responsive web · Customer portals

Cross-browser and visual regression audits across Chromium, Safari, Firefox and real mobile devices, Core Web Vitals checks (LCP, CLS, FID) on landing pages, lead and newsletter forms probed with XSS and SQL injection payloads, and analytics beacons inspected to confirm conversion and CTA events fired correctly.

  • Cross-browser QA
  • Core Web Vitals
  • XSS / SQLi checks
  • Analytics verification

Want the detail behind these?

I can walk you through the test strategy and the defects I caught in an interview.

Get in touch
01 / 07

Keep scrolling — cards move sidewaysSwipe to see more →

Personal projects · Development expertise

Backends and apps I built end to end

Open-source work that shows the developer side, and why I read the payload and the database row, not just the screen.

Dev projectIn progress

Full-Stack E-Commerce Platform

NestJS · Next.js · PostgreSQL

The project I am building now: a NestJS API on PostgreSQL through Prisma, with a Next.js storefront on top. The repository goes public once it is complete.

  • NestJS
  • Next.js
  • PostgreSQL
  • Prisma
  • TypeScript
Repository goes public on completion
QA project

Automated REST API Testing Framework

Personal project

A headless API regression framework in TypeScript with Postman and Newman: multi-tier CRUD lifecycles, auth headers and rate-limit behaviour, with JSON Schema validation on every response and HTML reports for gating staging deploys.

  • TypeScript
  • Postman
  • Newman
  • JSON Schema
  • CLI reporting
Repository not public yet
Dev projectMH-Mubin/headless-e-commerce

Headless E-Commerce API

Node.js · TypeScript

A headless commerce backend with a multi-variant product catalogue, token-based guest carts, a promotions engine and a full order workflow, using MongoDB aggregation pipelines for reporting.

  • Express.js
  • MongoDB
  • Mongoose
  • Zod
  • Swagger
  • Jest
View code
Dev projectMH-Mubin/school-management

School Management API

Express · PostgreSQL

School administration API with JWT authentication and role-based access for Admin, Teacher and Student, covering student records and class enrolment on PostgreSQL with Drizzle ORM.

  • TypeScript
  • Express.js
  • PostgreSQL
  • Drizzle ORM
  • Docker
View code
Dev projectMH-Mubin/bookmark-application

Bookmark API

NestJS · Prisma

A NestJS bookmark manager with signup/signin, Prisma data access and an end-to-end test suite in Pactum running against a Dockerised database.

  • NestJS
  • TypeScript
  • Prisma
  • PostgreSQL
  • Docker
  • Pactum
View code
Dev projectMH-Mubin/breathing-app

Breathing & Meditation App

React · Node.js

A full-stack MERN app with curved-path SVG breathing animations, multiple breathing patterns, session tracking, streaks and achievements behind JWT auth.

  • React
  • Vite
  • Framer Motion
  • Express.js
  • MongoDB
  • JWT
View code
Dev projectMH-Mubin/Inventory-Management

Inventory Management System

Node.js · MongoDB

Inventory and sales backend covering stock tracking, purchase and sales transactions, returns with data integrity, supplier and customer records, and reporting.

  • Express.js
  • MongoDB
  • Mongoose
  • JWT
  • Nodemailer
  • Helmet
View code
Dev projectMH-Mubin/Task-Manager

Task Manager API

Node.js · MongoDB

Task management backend with email-based JWT authentication, OTP verification through Nodemailer, password reset and protected CRUD routes.

  • Express.js
  • MongoDB
  • Mongoose
  • JWT
  • Nodemailer
  • CORS
View code

More on GitHub

All public repositories, with full commit history.

github.com/MH-Mubin
01 / 08

Keep scrolling — cards move sidewaysSwipe to see more →

05GitHub

GitHub activity

Repositories and languages come straight from the GitHub API and refresh every hour.

32

Public repositories

Backends, apps and data work

130+

Commits

In the last 12 months

2019

On GitHub since

7 years of public work

5

Languages

JavaScript, TypeScript, Python

Languages

Share of my 24 repositories with a detected language

  • JavaScript 38%
  • TypeScript 25%
  • Python 21%
  • HTML 8%
  • CSS 8%

Most used in my projects

Ranked by how many of my projects use them

  • Express.js
  • TypeScript
  • MongoDB
  • PostgreSQL
  • Mongoose
  • JWT
  • NestJS
  • Prisma
  • Docker
  • Nodemailer

breathing-app

A full-stack MERN app with curved-path SVG breathing animations, multiple breathing patterns, session tracking, streaks and achievements behind JWT auth.

JavaScriptOct 14, 2026

school-management

School administration API with JWT authentication and role-based access for Admin, Teacher and Student, covering student records and class enrolment on PostgreSQL with Drizzle ORM.

TypeScriptJan 19, 2026

headless-e-commerce

A headless commerce backend with a multi-variant product catalogue, token-based guest carts, a promotions engine and a full order workflow, using MongoDB aggregation pipelines for reporting.

TypeScriptAug 24, 2025

bookmark-application

A NestJS bookmark manager with signup/signin, Prisma data access and an end-to-end test suite in Pactum running against a Dockerised database.

TypeScriptAug 13, 2025

Inventory-Management

Inventory and sales backend covering stock tracking, purchase and sales transactions, returns with data integrity, supplier and customer records, and reporting.

JavaScriptMay 30, 2025

Task-Manager

Task management backend with email-based JWT authentication, OTP verification through Nodemailer, password reset and protected CRUD routes.

JavaScriptApr 23, 2025
View full GitHub profile

06Contact

Let's talk about your next release.

I'm open to SQA and test automation roles, and happy to talk about full-stack work too. Send a message and I'll get back to you.

Send a message