About

I build data systems, and I study how systems fail.

I am Ndemafia Wilsmith, a software engineer at Deacons Publishers, where I build the document AI and data pipelines behind the Prep50 study platform. Outside that work, I look for access control flaws in production systems and report them privately.

What I work on

My main work is data engineering for an exam preparation product. That means OCR over scanned textbooks and exam papers, a production question corpus in PostgreSQL, vector search, and LLM classification with checks around it. Most of the difficult work is making failures show up, not getting the normal case to run.

My security research started in October 2024, when I noticed that BillPoint, a payments app I was using, would return another customer’s phone number and wallet balance from their email address. I confirmed it on my own account and reported it privately. In October 2025 I reported a broken access control flaw to Miva Open University, which fixed it and paid a bounty. In December 2025 I reported a flaw in the Corporate Affairs Commission’s document system through ngCERT, which validated it within 48 hours.

I also built and deployed blordgroup.ng for B-Lord Group as sole developer. Finding authorisation bugs in other people’s systems is the main reason I check authorisation early in my own.

ROLE
Software Engineer, Deacons Publishers (Prep50), 2025 to present
FOCUS
Document AI, data pipelines, access control testing
DISCLOSED TO
CAC · Miva Open University · BillPoint
VALIDATED BY
ngCERT
SHIPPED
blordgroup.ng
CODE
github.com/ndemafiawilsmith
LOCATION
Remote
Science fair, 2019

MILSET Expo-Sciences International, Abu Dhabi

My secondary school selected me, and covered the cost, to exhibit at MILSET Expo-Sciences International in Abu Dhabi, an international science fair for young scientists.

My project was a carbon dioxide emission reducer for vehicle exhausts. It passed exhaust gas through a chemical treatment that converted the acidic carbon dioxide into a basic compound, so less of it reached the air.

EVENT
MILSET ESI 2019
HOST CITY
Abu Dhabi, UAE
PROJECT
CO₂ emission reducer
ROLE
Exhibitor, school funded

From the exhibition floor

ABU DHABI · UAE

Ndemafia Wilsmith wearing an ESI 2019 participant badge and carrying a laptop in the exhibition concourse in Abu Dhabi.
Accredited participant, ESI 2019
The delegation on stage holding a flag, wearing medals and holding certificates.
The delegation on stage
Delegates gathered in front of the large SPEAK SCIENCE lettering in the main exhibition hall.
The main hall, “Speak Science”
Presenting the exhibit to a group of visiting schoolchildren on the exhibition floor.
Presenting to visiting students
Standing with the South Korean delegation at their exhibit stand.
The South Korean stand
Full-length photograph on the exhibition concourse beneath the ESI 2019 signage.
ESI 2019 concourse
Seated with an Emirati host in the majlis area of the exhibition floor.
Hosted in the majlis
With delegates from other national teams, each in their country's traditional dress.
Delegations meet
With a fellow delegate during the exhibition.
Between sessions
Milestones

The record so far

  1. 2019

    Exhibitor at MILSET Expo-Sciences International, Abu Dhabi

    My secondary school selected and funded me to exhibit a chemistry project: a device that reduces carbon dioxide emissions from vehicle exhaust by chemically converting the acidic gas into a basic compound.

  2. OCT 2024

    First disclosure: BillPoint

    While using the BillPoint payments app as a customer, I found an account lookup that exposed other users' phone numbers and wallet balances. I confirmed it on my own account only and reported it privately.

  3. 2025

    Joined Deacons Publishers (Prep50) as a Software Engineer

    Sole engineer on the data side of an exam preparation platform: OCR, the production question corpus, vector search and LLM classification.

  4. OCT 2025

    Disclosure to Miva Open University

    Reported a broken access control flaw exposing student data directly to the university's CTO. It was fixed and a bug bounty was paid.

  5. DEC 2025

    ngCERT validation at the Corporate Affairs Commission

    Reported a broken access control flaw in the federal corporate registry's document system to ngCERT, which validated it within 48 hours.

  6. 2026

    102 scanned textbooks turned into a cited, searchable corpus

    31,887 pages OCR'd, 83,807 sections linked into a searchable corpus, and 99.3% of sections given a page citation, for $38 in total cash spend.

How I work

Measure before choosing

Thresholds, worker counts and instance sizes come from measurements on the real data. Most of my worst bugs were numbers I carried over without checking.

Make failures visible

A job that reports success while skipping data is worse than one that crashes. I keep failed and empty as different states so nothing is lost quietly.

Report privately first

When I find a flaw, the organisation that owns the risk hears about it before anyone else, with enough detail to fix it.

Get in touch

Hiring, or working on a hard data problem?

I am open to engineering roles and contract work in document AI, data pipelines and web. Vulnerability reports go to the security address.

Contact me
Contact me
Report a vulnerability