Home turf
InsurTech
Digital insurance from the first quote to the paid claim.
- OSAGO / KASKO issuance & renewals
- Underwriting & scoring engines
- Claims workflows, agent CRMs
Hojiakbar Saidrasulov — CTO. I build systems
CTO of Semurg Insurance, full-stack engineer and cybersecurity specialist in Tashkent. I design, build, secure and run software for InsurTech, FinTech, AgroTech — and every industry in between.
- Websites shipped
- 30+
- CRM platforms
- 20+
- ERP systems
- 2
- Projects delivered
- 50+
- Java
- Spring Boot
- TypeScript
- React
- Next.js
- NestJS
- FastAPI
- Python
- PostgreSQL
- MongoDB
- Redis
- Docker
- Nginx
- Linux
- Cloudflare
- MikroTik
- Asterisk
- Kali Linux
- Burp Suite
- React Native
- PWA
- Prisma
- Tailwind
Core capabilities
Full-stack apps
Web, CRM, ERP and PWA — typed end-to-end.
Cybersecurity
Hardening, audits and authorized pentests.
DevOps & infrastructure
Docker, CI/CD, zero-downtime deploys.
SysAdmin & network
Linux, MikroTik, UniFi, VoIP telephony.
Mobile & PWA
App-grade experiences that install.
What I build
Everything a business
Full-stack developer and cybersecurity specialist in Tashkent — CRMs, ERPs, client portals and the dashboards on top, built as one secure platform instead of ten disconnected tools.
- CRM, client portals and agent cabinets
- ERP: finance, HR, documents, approvals
- Policy issuance with E-IMZO e-signature
- Payments, reconciliation and reporting
- Real-time analytics and dashboards
- Role-based access and a full audit log
Interface preview · demo data
One engineer.
Most teams need five people to go from idea to a secured, monitored production system. You need one conversation.
- 01 / 05
Full-stack engineering
From pixel to database row.
Product-grade web apps, CRMs, PWAs and ERPs. Typed end-to-end, fast on a 3G phone, boring to operate — exactly how production should be.
- Java
- Spring Boot
- TypeScript
- React
- Next.js
- NestJS
- FastAPI
- PostgreSQL
- 02 / 05
Cybersecurity
Security is the architecture, not a plugin.
Threat modelling, hardened auth, network segmentation, content filtering and continuous monitoring across the whole office perimeter.
- OWASP
- Zero-Trust
- MFA / TOTP
- WAF
- Audit
- Hardening
- 03 / 05
System administration
The servers nobody has to think about.
Linux & Windows fleets, MikroTik / UniFi networks, FreePBX / Asterisk telephony, backups that are actually restored and tested.
- Linux
- MikroTik
- UniFi
- Asterisk
- FreePBX
- Backups
- 04 / 05
DevOps & infrastructure
Ship daily. Sleep nightly.
Containerised stacks, zero-downtime deploys, Cloudflare edge, tunnels, observability and rollback plans written before they are needed.
- Docker
- CI/CD
- Nginx
- Cloudflare
- Monitoring
- IaC
- 05 / 05
Offensive security
I think like the attacker — so you never meet one.
Authorized penetration testing, recon and red-team exercises. Every finding ships with a fix, a regression test and a plain-language report.
- Pentest
- Recon
- Burp Suite
- Kali
- Red Team
- Reporting
Industries
Built for
Insurance and finance are home turf — the same engineering discipline ships in agriculture, government, education, health and beyond.
- Home turf
FinTech
Money-moving software where every tiyin must reconcile.
- Payment gateway integrations
- Ledgers, reconciliation, reporting
- KYC, onboarding, fraud signals
- Home turf
AgroTech
Farm data, scoring and insurance for the fields that feed the country.
- Crop & farmer scoring systems
- Field / harvest data platforms
- Agro-insurance products
GovTech
E-services, registries and national catalogues.
EdTech
LMS, exams, student and course platforms.
HealthTech
Clinic CRMs, bookings and patient records.
Logistics
Fleet, shipment tracking and warehouse apps.
E-commerce
Stores, marketplaces, payments and delivery.
PropTech
Listings, developer CRMs and sales portals.
Telecom & VoIP
Asterisk / FreePBX call centres and IVR.
EnergyTech
Metering, monitoring and field-ops tooling.
TravelTech
Booking engines, tours and event platforms.
HRTech
Recruiting, attendance and payroll systems.
LegalTech
Document flows, e-signature and archives.
Media & Events
Summits, content sites and live dashboards.
Manufacturing
Production tracking, inventory and ERP.
Selected work
Shipped, secured,
Production systems for insurance, finance and government — plus everything I build in the open on GitHub.
- InsurTech · Internal platform
Semurg Insurance · 2026
InternalIn production · internalRegress (subrogation) case dashboard
An operations dashboard for insurance regress (subrogation) cases — every claim paid out and recovered from the liable party, tracked from registration to court decision.
- Next.js
- TypeScript
- Radix UI
- React Hook Form
- REST API
Company websiteLumarc, architecture & design · 2026
LiveLumarc — studio website
The public face of an architecture and design studio in Uzbekistan: projects, team, blog and recognition — built and shipped solo in three months.
- TypeScript
- Next.js
- Tailwind CSS
- PostgreSQL
ERP · Company-wideSemurg Insurance · 2026
InternalIn production · internalNAP ERP
The ERP the company’s internal operations run on — deployed on its own isolated edge with a dedicated reverse proxy and Cloudflare Tunnel, so a failure elsewhere can’t take it down.
- Docker
- Nginx
- Cloudflare Tunnel
- Linux
Private system · NDA
CRM · OperationsComputer & gaming club · 2025
GameClub platform
Run a computer club from one screen: rooms, PCs, tariffs, operators and bookings, with live PC status streamed over WebSocket and remote control from the operator desk.
- React
- FastAPI
- SQLAlchemy
- WebSocket
- PHP
Cybersecurity · NetworkSemurg Insurance · 2026
InternalIn production · internalOffice security platform
Real-time monitoring and control of the whole office network — devices, traffic and content filtering on MikroTik, with a UniFi dashboard for the Wi-Fi side.
- Python
- MikroTik API
- UniFi
- FastAPI
Private system · NDA
GovTech · CatalogueNational export programme · 2025
LiveUZBEX export catalogue
A national catalogue of Uzbek exporters and their products, prepared for official trade delegations and served through Cloudflare.
- Linux
- Cloudflare Tunnel
Live
More production work
Semurg Ventures Capital
FinTech · Venture
Venture fund website with a Telegram intake bot whose outbox guarantees no application is ever lost.
Next.jsNestJSPrismaTelegramUzbek speech-to-text
AI · Speech
Uzbek speech recognition with a local web app: model selection took WER from 86% to 8.3%, inverse text normalisation to 2.9%.
PythonASRITNWeb UISemurg App
InsurTech · Mobile
OSAGO and KASKO in a native app — buy, renew and claim — on an Expo + NestJS monorepo.
ExpoReact NativeNestJSIn development
Open source
since 2025.
Dashboards, APIs, bots and experiments — JavaScript, TypeScript, Java, PHP and Python, all readable on GitHub.
- TypeScript2026
Insurance regress dashboard (opens in new tab)
Next.js dashboard for insurance regress cases: registry, debtors, court process and analytics.
Next.js · TypeScript · Radix UI
- TypeScript2025
DualForge Labs platform (opens in new tab)
Multi-page agency site: services, case studies, pricing calculator, careers, blog and a Telegram-wired quote form.
Next.js · TypeScript · Tailwind
- TypeScript2026
NestJS auth API (opens in new tab)
REST API with JWT/Passport auth, Prisma ORM, validation and Swagger docs.
NestJS · Prisma · JWT · Swagger
- TypeScript2025
NestJS users service (opens in new tab)
NestJS service with TypeORM, hashed passwords, e-mail delivery and OpenAPI docs.
NestJS · TypeORM · Swagger
- JavaScript2025
GameClub — web app (opens in new tab)
React client and admin: PCs, rooms, tariffs, operators and bookings.
React · Framer Motion · Axios
- Python2025
GameClub — API (opens in new tab)
FastAPI backend with auth, tariffs, room/PC management and live status over WebSocket.
FastAPI · SQLAlchemy · WebSocket
Java fundamentals path14 repositories
- OOP exercises (opens in new tab)
- Constructors (opens in new tab)
- Math functions (opens in new tab)
- Inheritance (opens in new tab)
- Polymorphism (opens in new tab)
- Polymorphism · overriding (opens in new tab)
- Abstraction (opens in new tab)
- Interfaces (opens in new tab)
- OOP · task 1 (opens in new tab)
- OOP · task 2 (opens in new tab)
- ArrayList (opens in new tab)
- LinkedList (opens in new tab)
- HashSet (opens in new tab)
- Map (opens in new tab)
Hojiakbar Saidrasulov
CTO · Full-stack engineer · Cybersecurity
Tashkent, Uzbekistan Available for new projects
About
Hojiakbar Saidrasulov. Engineer by training,
I’m Hojiakbar Saidrasulov — CTO of Semurg Insurance and a cybersecurity engineer from Tashkent, Uzbekistan. I study cybersecurity at TUIT (TATU) and ended up running the technology of an insurance company: the internal platforms, the servers, the office network and the phones. That mix shapes how I build — every product is designed by someone who will also have to secure it, deploy it and keep it alive at 3 a.m.
Also written: Saidrasulov Hojiakbar · Xojiakbar Saidrasulov · Khojiakbar Saidrasulov · Хожиакбар Саидрасулов · Ҳожиакбар Саидрасулов · Ходжиакбар Саидрасулов
CTO · Full-stack & infrastructure · Semurg Insurance
Present
Internal platforms, ERP and dashboards, office network security, servers and telephony.
Full-stack developer (TypeScript) · Lumarc
Nov 2025 — Present
Next.js, React, Node.js and PostgreSQL; shipped the company website solo in three months.
Full-stack developer (Java & JavaScript) · Freelance
Dec 2023 — Present
Spring Boot, React, Node.js, PostgreSQL, MongoDB and Redis for startups and businesses.
Education
Cybersecurity Engineering, B.Sc.
TATU — Tashkent University of Information Technologies
2023 — Present
Java Full-stack Developer
Mohirdev · certificate
2025
Languages
- UzbekNative
- EnglishTechnical & business
- RussianTechnical documentation
Uzbekistan · UTC+5
Based in Tashkent. Working with teams wherever they are.
Integrations
Plugs into the systems
Payments, e-signature, SMS, messaging, networks and telephony — connected, secured and monitored.
- Telegram
- E-IMZO
- Eskiz SMS
- PostgreSQL
- Payme
- Click
- Stripe
- Docker
- Cloudflare
- Redis
- MikroTik
- UniFi
- Asterisk
- Nginx
- Spring Boot
- Prisma
- FastAPI
- NestJS
- Telegram
- E-IMZO
- Eskiz SMS
- PostgreSQL
- Payme
- Click
- Stripe
- Docker
- Cloudflare
- Redis
- MikroTik
- UniFi
- Asterisk
- Nginx
- Spring Boot
- Prisma
- FastAPI
- NestJS
Process
Idea to production,
- 01
Discover
Business goal, risks and constraints on one page.
- 02
Architect
Data model, API contract and threat model before code.
- 03
Build
Typed, tested, reviewed. Small releases, real feedback.
- 04
Secure
Hardening, pentest, secrets and access audited.
- 05
Deploy
Containers, zero-downtime rollout, instant rollback.
- 06
Operate
Monitoring, backups, alerts — and someone who answers.
Security mindset
Ethical by default. Offensive
I break systems for a living — with written authorization — so that nobody else gets the chance. Every engagement ends with fixes merged, not a PDF in a drawer.
- Authorized pentest & red-team
- Hardening: Linux, Windows, network edge
- MFA, secrets, least-privilege access
- Incident response & forensics
ssh hojiakbar@saidrasulov.com — 80×24
SaidrasulovOS 5.0 — secure shell established (ed25519)
type `help` to list commands
Work with me
Three ways
Every engagement starts with a discovery call and ends with a written plan, a clear scope and a quote.
Build a product
Launch
A website, CRM, PWA or ERP taken from idea to production.
Custom quote · after discovery
- Discovery & architecture
- Design → production code
- CI/CD, monitoring, backups
- Docs and hand-over
- Most requested
Audit & pentest
Secure
Find the holes before someone else does — then close them.
Custom quote · after discovery
- External & internal pentest
- Server and network hardening
- Fixes merged, not just reported
- Re-test after fixes
Monthly care
Operate
DevOps and SysAdmin on call, so your team can ship.
Custom quote · after discovery
- 24/7 uptime monitoring
- Patching & restore-tested backups
- Incident response
- Monthly health report
FAQ
Questions,
Something else on your mind? Ask me directly — I usually reply within a day.
Who is Hojiakbar Saidrasulov?
Hojiakbar Saidrasulov (also spelled Xojiakbar or Khojiakbar; Cyrillic: Хожиакбар / Ҳожиакбар Саидрасулов) is the CTO of Semurg Insurance in Tashkent, Uzbekistan — a full-stack engineer and cybersecurity specialist who designs, builds and secures CRMs, ERPs, PWAs and InsurTech / FinTech platforms.
What kind of projects do you take on?
Anything where reliability matters: company websites, CRMs, PWAs, ERPs, internal tools, integrations, security audits and infrastructure. InsurTech and FinTech are home turf, but the same engineering applies everywhere.
Can you take over an existing codebase or server?
Yes. I start with a short audit — code, infrastructure, security and backups — and hand you a written list of risks and priorities before changing anything.
How do you approach security?
From the first sketch: threat model, least-privilege access, secrets out of code, MFA, hardened servers, logging and tested backups. Security is part of the architecture, not a final checkbox.
Is penetration testing legal?
Only with written authorization and an agreed scope — that is the only way I work. You get a plain-language report, the fixes and a re-test.
What does a typical timeline look like?
It depends on scope. After a discovery call you get a written plan with milestones and an estimate; work ships in small, reviewable releases so you see progress every week.
Do you support projects after launch?
Yes — monitoring, updates, backups and incident response can continue on a monthly basis, or I hand over clean documentation to your team.
Available for new projects
Let’s build something that lasts.
A new platform, a CRM that finally fits, a security audit or infrastructure that stops paging you at night — tell me about it.
