Head of AI / Forward Deployed Engineer at BloomX (formerly CDX Pay). I build AI agents that actually work in production, and I build them to be secure.
- Shipping software since 2008. Blockchain since 2020: smart contract security audits across EVM, Substrate and Solana. AI agents since 2022.
- At BloomX I lead a team of 7 engineers. Our agents helped take card sales from zero to R$100k+/day. How we work: R$100k/day: how I use AI agents to ship payments code.
- Founder of OpenSense, a Web3 security community and YouTube channel (Ethereum Foundation grantee).
- Based in Florianópolis, Brazil, relocating to Canada.
- Secure agents. I treat agents like any other untrusted code path: assume adversarial input, scope permissions tightly, log enough to debug at 2am, and make them prove their work before calling it done.
- Rhino, a security agent I'm building.
- Leash, an open-source framework for secure agents. Not public yet; it will land here.
- Agent knowledge that lives in the repo, not on one engineer's laptop: article + working example in agent-knowledge-demo.
| Repo | What it is |
|---|---|
| agent-knowledge-demo | AGENTS.md, Agent Skills and a memory log kept in the repo, owned via CODEOWNERS and checked by CI. Companion to the article above. |
| canopy | A discipline skill for solo coding agents: agents don't say done, they prove it. |
| ethSight | Read-only Ethereum investigation CLI: wallets, approvals, value flows, with an LLM "explain this" mode. Where my security and AI work overlap. |
| furniture-vision-search | Photo in, ranked catalog matches out: vision extraction, hybrid retrieval, LLM rerank with per-result reasoning, eval harness first. |
| prediction-bot-research | 31k rounds, walk-forward and adversarial audit, honest verdict: no deployable edge. The methodology is the point. |
| DamnVulnerableDefi-solutions | My solutions to the Damn Vulnerable DeFi security CTF. |
- Security: smart contract auditing (Foundry, Slither, Echidna, fuzzing, invariant testing), on-chain forensics, post-incident investigation. Designed and shipped Zokyo's CTF platform and bug bounty program.
- Engineering: TypeScript, Node.js, Python, Solidity, PostgreSQL, Redis, Kafka. Backend systems for platforms serving millions of users (Catho, Endouble).
- Leadership: CTO at Avem (permissioned ledger for regulated environments), engineering lead at EDUXE.
- Polkadot Blockchain Academy, University of Cambridge, 2022.
X @melocalex · LinkedIn · YouTube: OpenSense · alexandre.carvalho.melo@gmail.com
Open to Forward Deployed Engineer, AI Solutions Architect, Staff/Principal AI Engineer, AI DevRel and blockchain security roles. Remote or Canada.