Zack Deveau
Staff Application Security Engineer
Canada
Summary
🤩
Rockstar🎓
Top SchoolZack Deveau is a Staff Application Security Engineer at Shopify with 11 years of experience building secure, high-performance backend systems. He progressed through multiple security and developer roles at Shopify, combining hands-on engineering with threat mitigation and secure-by-design practices. Zack is an active open-source contributor to flagship Ruby projects—helping optimize YJIT internals and harden Rails by replacing unsafe YAML deserialization and tightening redirect and image transformation logic. His background spans low-level C development and applied cybersecurity at Bell, giving him a practical grasp of both performance tuning and attack surface reduction. Based in Canada, he brings a pattern-driven approach to finding subtle vulnerabilities and squeezing extra performance from runtime systems. An uncommon blend of compiler-level expertise and application security makes him effective at fixing root causes rather than symptoms.
11 years of coding experience
7 years of employment as a software developer
Bachelor’s Degree Computer Science, Bachelor’s Degree Computer Science at University of New Brunswick
English, French
Github Skills (21)
ruby-rails10
performance-monitor10
performance-analytics10
rails10
performance-measurement10
security10
ruby10
performance-analysis10
compiler-optimization10
performance-tuning10
activerecord10
rust10
performance-monitoring10
programming-language9
jit9
Programming languages (4)
Github contributions (5)
rails/rails
Jul 2021 - Nov 2022
Ruby on Rails
Role in this project:
Back-end Developer
Back-end DeveloperContributions:5 reviews, 17 commits, 5 PRs in 1 year 4 months
Contributions summary:Zack primarily focused on enhancing the Rails framework by addressing security vulnerabilities and improving core functionalities. Their contributions included changing the default YAML deserialization to safe_load to mitigate security risks and adding checks for illegal characters in the redirect_to method. They also worked on the ImageProcessingTransformer, adding both an allow-list and a deny-list to control transformation methods and arguments. Additionally, they addressed various other security issues by sanitizing HTML content attachments within ActionText.
ruby-on-railsrailsframeworkrubymvc
ruby/ruby
Nov 2022 - Sep 2024
The Ruby Programming Language
Role in this project:Back-end Developer & Performance Engineer
Back-end Developer & Performance EngineerContributions:4 reviews, 7 PRs, 7 comments in 1 year 9 months
Contributions summary:Zack primarily focused on optimizing the Ruby programming language's YJIT (Yet Another JIT) compiler backend. Their contributions include porting new opcodes (checktype, concatstrings, opt_str_freeze, opt_str_uminus, opt_getinlinecache) to the new IR assembler backend, suggesting in-depth knowledge of compiler internals. They also addressed performance issues in string manipulation (rindex) and array sorting, indicating a focus on overall Ruby performance improvement. Furthermore, the user added missing counters for debugging, demonstrating work on the internal instrumentation.
object-orientedruby-languageprogramming-languagerubyc
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.