ratomir.com
A crew of small agents assembles the page in front of you. It takes about five seconds, and you can skip at any time.
Ratomir Jovanovic · Dubai
I lead product for payment flows, APIs and AI features in regulated markets, and I still build. 18 years in SaaS, fintech and payments. Former Head of Product at Webio (acquired by Aryza in 2025), CPO at Payshen.
Open to Head of Product, Director of Product and CPO roles in payments and fintech infrastructure, across the UAE, the EU, the USA, Canada and Switzerland, or remote.

Webio
Head of Product, 02/2023 - 05/2025. Conversational AI for collections and payments, used by Tier 1 enterprises. Acquired by Aryza in 2025.
Aryza announcement
Payshen
Chief Product Officer. Payment orchestration: one API for many providers, routing to the provider most likely to approve. SDKs on npm, PyPI, Packagist and WordPress.org.
payshen.com
Open source
An HMAC validation issue I reported was fixed across Adyen’s Node, Java and .NET libraries. Fixes and reviews merged at Twilio, Svix and Standard Webhooks.
All contributions
Security
ISO/IEC 27001:2022 Lead Auditor (CQI/IRCA). Found and defensively registered wpad.rs in 2024.
Press
Scope
Built for audits and enterprise procurement from the first sprint.
Approval rates, routing, retries, fees and reconciliation, owned with metrics and a roadmap instead of tickets.
API design, SDKs, webhooks and docs that match the code. I ship SDKs myself and review payment code in public.
Conversational AI, LLM evaluation, guardrails and audit trails that a bank’s security team can approve.
Work
Head of Product · 02/2023 - 05/2025
Conversational AI for collections and payments, through the acquisition by Aryza.
Read the case study
Chief Product Officer · 11/2025 - Present
Payment orchestration: one API for many providers, with a recorded reason for every routing decision.
Read the case study
Chief Product Officer · 09/2016 - 11/2018
Writing
All essaysAI made building cheap. Knowing what is worth building is now the job.
Approval rates, retries, failure messages, fees and reconciliation shape revenue and customer trust directly. That makes payments a product area with an owner, metrics and a roadmap.
Most LLM features that disappoint in production were judged badly, not built badly. A practical evaluation process for product leaders: job definition, golden sets, failure taxonomy, budgets and a ship/no-ship rule.
A B2C mobile product from concept to launch, with churn cut by more than 32%.
Read the case study
Open source
I review and fix payment, webhook and auth code in public. I also build PandaWard, a local application security engine that keeps evidence for every finding and states what it did not test.
Updated hourly from public GitHub data
6
Fixes merged
Pull requests I wrote, merged by maintainers; 9 more in review
25
Pull requests reviewed
Across 20 projects; 9 merged after the review
18
Issues reported
5 already fixed upstream
41
Other projects
Including Adyen, Go, Twilio, Google, Medusa and the MCP SDKs
Reported and fixed
Reported that the Node HMAC validator accepted a malformed key as an empty one. Adyen confirmed it and asked for fixes across its SDKs: merged in Node, Java and .NET, with PHP, Python, Go and Ruby in review.
Review adopted
HMAC-SHA256 webhook support in twilio-node: the Express middleware still checked SHA-1 only. Twilio fixed it in the PR and merged it.
Reported and fixed
Reported that oauth2.DeviceAccessToken panics when a server returns a negative or very large polling interval; fixed in golang.org/x/oauth2.
Opened pull request #432 in ratomirjovanovic/pandaward
Merged pull request #431 in ratomirjovanovic/pandaward
Opened pull request #431 in ratomirjovanovic/pandaward
Pushed commits in ratomirjovanovic/pandaward
feat/406-js-redos
Merged pull request #430 in ratomirjovanovic/pandaward
Closed issue #424 in ratomirjovanovic/pandaward
Let users sponsor PandaWard through GitHub Sponsors