Zach Lavallee
Software Engineering Manager at FOSSA
San Francisco, California, United States
Summary
🤩
Rockstar🎓
Top SchoolZach Lavallee is a software engineering manager based in San Francisco with eight years of experience blending startup grit and production-grade engineering. A UW–Madison mechanical engineering graduate who pivoted into software via CS research, he co-founded an IoT hardware startup before moving into backend and security tooling at FOSSA. He leads a cross-language team (Rust, Haskell, Go, TypeScript) building dependency, license, and vulnerability analysis for large codebases and complex on‑prem environments. Zach is an active OSS contributor—he added Ruby and PHP lockfile parsing to the widely used FOSSA CLI—bringing practical expertise in dependency analysis and CI-driven development. He combines systems thinking from hardware and manufacturing with deep backend engineering and a focus on reliable, auditable tooling.
8 years of coding experience
9 years of employment as a software developer
Highschool, Highschool at St. Louis Priory SchoolBachelor of Engineering (BEng) Mechanical Engineering, Bachelor of Engineering (BEng) Mechanical Engineering at University of Wisconsin-Madison
Github Skills (8)
php10
parser10
parsing10
parse10
dependency-analysis10
ruby10
json8
yaml8
Programming languages (10)
Github contributions (5)
fossas/fossa-cli
Sep 2018 - Jan 2023
Fast, portable and reliable dependency analysis for any codebase. Supports license & vulnerability scanning for large monoliths. Language-agnostic; integrates with 20+ build systems.
Role in this project:
Back-end Developer
Back-end DeveloperContributions:60 releases, 160 reviews, 250 commits in 4 years 4 months
Contributions summary:Zach primarily focused on adding and improving Ruby-based dependency analysis within the FOSSA CLI tool. Their contributions include initial support for parsing and analyzing `Gemfile.lock` files, essential for identifying Ruby gem dependencies. They implemented parsing logic to extract dependency information and the related version details. Additionally, the user added support for analyzing `composer.lock` files which is part of the PHP ecosystem.
agnosticcodebaseopen-source-licensinglanguage-agnosticportable
zlav/vuln_django_play
Oct 2020 - Aug 2022
🐛 An intentionally vulnerable Django app
Contributions:2 PRs, 13 pushes, 2 branches in 1 year 9 months
vulnerablepythondjango2djangosecurity
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.