Przemysław Zalewski

C# and .NET, 2009 to 2021

A .NET developer for the system nobody wants to touch

Ten years of C#, .NET, ASP.NET, Entity Framework and XAML, including my own chat app on sharded .NET servers with 30,000 concurrent users. TypeScript and Node.js since 2017. First I map what the system really does and pin it with tests. Then I keep it running, and when the time comes, migrate it piece by piece instead of rewriting it from scratch, with the old system live until the numbers agree.

Book a free 30‑min call Email me instead

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
10+years of C# and .NET, through 2021
30,000concurrent users on my own chat app
260+merged PRs of my own in 2026, plus 300+ reviews of other engineers’ PRs
15+years shipping software

Sound familiar?

C# and .NET problems I fix in 2026

Is our ASP.NET Core app exposed to the 9.4 Kestrel CVE?

On 13 October 2026 Microsoft published CVE‑2026‑88092, request smuggling in Kestrel rated 9.4, affecting .NET 8, 9 and 10. The fixes are in 8.0.32, 9.0.21 and 10.0.13, and self-contained apps stay vulnerable until they are recompiled and redeployed (GitHub advisory).

I find every app and package that ships Kestrel, upgrade runtimes and packages in waves you can revert, and redeploy. When React2Shell hit in December 2025, my clients’ apps were patched the same day.

Our .NET Framework app still runs on Windows Server 2016

Extended support for Windows Server 2016 ends on 12 January 2027, and containers released with it end the same day (Microsoft Learn). After that the server, and the app on it, get no security updates.

I make the build reproducible, put tests around the parts people fear, then move the app to a supported server or carve the busiest endpoints into a TypeScript service, one at a time. From 2017 I worked on a US instrument maker’s .NET backend running on Windows Server behind its browser 3D product, so I know that setup from the inside.

Sound like you? Book a free 30‑min call →

Can GitHub Copilot migrate our .NET Framework app for us?

Microsoft now marks .NET Upgrade Assistant as deprecated and points teams to the GitHub Copilot modernization agent, which commits each change so you can validate or roll it back (Microsoft Learn, updated March 2026).

Validating is the real work. I pin behavior with tests first and run coding agents under enforced rules. In 2026 about two thirds of merged PRs across two products were built with coding agents, and nearly all went through my review or merge. If no model may see your code, I work without one.

Our solution only builds in Visual Studio 2017 on one old PC

Visual Studio 2017, including its Build Tools, leaves extended support in April 2027 (Microsoft Learn). If that one machine dies, so does your ability to ship a fix.

I move the build into GitHub Actions so anyone can produce the same artifact, then write the runbook and architecture notes from the code, so the system stops living in one person’s head. In August 2026 I retired a seven‑year‑old self-hosted CI server only I understood: builds moved to GitHub Actions, and releases stopped depending on my holidays.

Facing one of these? Book a free 30‑min call →

Why me

A legacy app your team can deploy again

Builds that pass again, dependencies updated in order, tests around the parts people fear, a deploy one person can run. Then the backlog of small fixes nobody had time for.

Migration without the big bang

Strangler pattern: a new TypeScript service in front, one endpoint at a time, both systems live until the numbers agree. I moved a desktop 3D product to the browser: React in front, a .NET backend around the client’s computation library.

Fluent in both directions

LINQ to array methods, Task<T> to Promise<T>, records to interfaces. The demo below does the mechanical part so the conversation can be about the design.

Scale I have run myself

Horizontally scaled, sharded C# servers, a moderation panel and automated NSFW detection for a product with 1.5M+ downloads. I know what production .NET looks like at 3 a.m.

Live demo

C# in, TypeScript out

A rule‑based translator that runs entirely in your browser. It converts properties, async Task<T>, LINQ chains, records and nullable types. It is deliberately simple: it shows which parts of a migration are mechanical and which need a human.

Demo loading…

Paste a class from your codebase. Wherever the output is wrong, the migration needs a human. Bring those lines to the call.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

A desktop 3D measurement product rebuilt for the browser, React in 2017

The problem
A US manufacturer of precision instruments had a desktop app for visualizing 3D scans and wanted feature parity in the browser.
What I did
WebGL and three.js for the scans, React for the interface, a .NET backend around the client’s computation library, Stripe billing, visual regression tests, shared team tooling. Measurement charts computed from scratch, no charting library, kept in sync with the 3D view. Work in English across a nine‑hour time difference, with weekly calls.
Result
Feature parity reached. When the client cut the team for budget reasons they chose which engineers to keep and I was one of two.

WebGL React 2017 1 of 2 kept

See also: React

Restarting delivery after three years of maintenance mode

The problem
A mature product had drifted into maintenance. The backlog was old and the team small.
What I did
Agent-assisted development under an enforced rule set, help docs migrated from WordPress into the repo as markdown with 301 redirects and i18n, help added to the Definition of Done.
Result
From about 60 commits in 2025 to 4,800+ by October 2026, about 80× year over year, one less server to break during holidays, docs that match the product.

~80× commits YoY docs‑as‑code

See also: AI & agents · AI in your company

Offer: AI‑built app stuck? Rescue in 2 to 8 hours

My own chat app: 30,000 concurrent users on sharded .NET servers

The problem
An ad-supported anonymous chat grew faster than one server could carry, and nobody else was going to run it.
What I did
Horizontally scaled, sharded C# and .NET servers, my own chat network, a moderation panel, automated NSFW detection, support answered by me.
Result
30,000 concurrent users, 1.5 million+ downloads and 37,000+ ratings across 21 national stores (4.5 average in the US). It paid my bills for five years and ended when Windows Phone did.

30,000 concurrent 1.5M+ downloads 5 years

Sources: Promegle, US store 2015: 17,378 ratings

See also: SaaS & MVP

Facing something similar? Book a free call →

Press

Written up elsewhere

Real links, from Windows Phone apps in 2012 to a game in 2020. Online I go by Ciunkos. Some outlets are gone, so those links open an archived copy.

Antyweb Award“The jury picked the best apps in the AppAward contest”AppAward 2013: Pogaduszki won the Other category on Windows Phone, out of 300 apps entered across iOS, Android and Windows Phone.Read (in Polish) Microsoft Polska“The best Polish apps for Windows Phone”Microsoft Poland’s hand‑picked list of the best Polish Windows Phone apps featured my Kwejk app (archived copy from September 2012).Read the archived copy (in Polish) wp7.com.pl“More about the Gadu app”A chat with me about Gadu: “for that period Gadu was the most downloaded app on the Polish Marketplace.”Read (in Polish) OnMSFT“Windows Store app highlight: Windows Phone Store, grab the latest Windows Phone apps via Windows 8”My Windows 8 app for browsing the Windows Phone Store, featured as a highlight.Read windows‑phone.pl“The »Windows Phone Store« app for Windows 8”“Built by Ciunkos, known for apps like Pogaduszki and Memgenerator.”Read the archived copy (in Polish) appsblog.pl“Memgenerator: make a funny picture on your phone”Review of Memgenerator, my Windows Phone meme maker.Read (in Polish)
More mentions (5)
Komórkomania“Pogaduszki: a Gadu‑Gadu client for Windows Phone”Review of Pogaduszki, my Gadu‑Gadu messenger: 4.5 stars from 68 ratings at the time.Read (in Polish) Telix.pl“Pogaduszki: a new GG client for Windows Phone”Launch of Pogaduszki for Windows Phone 7.5: free, no ads, push through my own server.Read (in Polish) wp7.com.pl“Unofficial GG client »Pogaduszki« now available”Pogaduszki ready “after many hours of work and testing”, no splash screen so it starts faster.Read (in Polish) windows‑phone.pl“Pogaduszki, a new GG client!”After my first Gadu‑Gadu app was pulled over a copyright claim, I rebuilt it as Pogaduszki without the infringing parts.Read the archived copy (in Polish) GaduNews“GG Network pulls an unofficial messenger from Windows Phone”Gadu, the first native Gadu‑Gadu client on Windows Phone 7, comes down after a trademark claim. Quotes my statement.Read the archived copy (in Polish)

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week C# & .NET (legacy) code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • A C# or .NET Framework app that must keep running while its future is decided
  • A migration to TypeScript and Node.js, one endpoint at a time, with both systems live
  • A solo engagement, or one team of up to four that I lead directly
  • Your code in your repository, your build in CI, a runbook at the end

Probably not when

  • A greenfield .NET microservice platform
  • A big‑bang rewrite with a fixed launch date and no tests
  • A ten‑person vendor team, or body leasing by the hour

Working style

How I work

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Review as a craft

800+ pull requests reviewed on one product since 2018. I review for the product and its reasons. The code comes second.

Good to know

.NET support dates and traps in 2026

.NET 8 and 9 end on the same day

Both lose support on 10 November 2026, because STS releases moved from 18 to 24 months starting with .NET 9 (.NET support policy, .NET blog).

.NET 10 is supported to November 2028

.NET 10 is the current LTS, supported until 14 November 2028. It is the target for anything moving off 8 or 9 (.NET support policy).

.NET Framework 4.8 follows Windows

Framework 4.5.2 and later has no lifecycle of its own: it is supported as long as the Windows it runs on (lifecycle FAQ). 4.6.2 itself ends on 12 January 2027 (Microsoft lifecycle).

ASP.NET Core 2.3 on Framework ends in April 2027

The last ASP.NET Core line that runs on .NET Framework reaches end of support on 13 April 2027, on every Framework version (ASP.NET support policy).

BinaryFormatter always throws

Since .NET 9 the built‑in BinaryFormatter throws even with the old opt‑in switches. Sessions, caches or files serialized with it break on upgrade (breaking change).

Microsoft recommends step-by-step migration

For large production apps, Microsoft’s own guide recommends incremental migration with the Strangler Fig pattern instead of a rewrite (migration guide).

FAQ

Questions people ask before they book

Do you still write C#?
When a client needs it, yes. My last production C# was 2021 and I say so. I am not the person for a greenfield .NET 10 microservice platform. I am the person who keeps a 2014 ASP.NET MVC app alive while the next thing is built, usually in TypeScript. Check it on your own code first: the one‑week audit runs on your repository, and if it needs a full‑time .NET specialist instead of me, the report says so.
Migrate .NET to Node.js, or keep it?
Keep it if it is stable and the team can hire for it. Migrate if every change takes a month and nobody dares to deploy. A one‑week code audit ($1,080⁠–⁠$2,160 excl. VAT) gives you the answer in writing, with the cost of both paths. The target stack is on the TypeScript and Node.js page.
What does maintenance look like, and what does it cost?
A fixed number of days per month at $36⁠–⁠54/h excl. VAT: builds, patches, dependency updates, monitoring, small features. Alerts route to me, so I hear about problems before you do. More on the maintenance page.
Windows Phone and XAML too?
That is where the 25+ apps and 3.7M+ downloads come from. The platform is gone, the discipline of shipping to a store and reading reviews stayed.
How long does a full migration take, and what will it cost?
Nobody honest can say before reading the code. The one‑week audit ends with a plan cut into slices. Each slice is then priced in writing with a cap I do not cross without asking. You can stop after any slice and keep everything done, because the code is in your repository from the first commit.
What if the migration stalls halfway?
You still have a working system. With the strangler pattern the old app keeps serving every endpoint that has not moved yet, and a moved endpoint can be routed back. There is no big cutover day to miss.
Our code is confidential. Who sees it, and does AI?
NDA is standard and I sign yours. I work in your repository and accounts, and nothing is shown anywhere without written consent. You choose the AI mode, including no AI at all, which is slower and costs more hours. With AI, training on your data is off and secrets never reach a model. I led Patriot Mail (built at Sanddev) through Google’s CASA Tier 2 security assessment twice, in January and October 2026. Details on how I work.
You are one person. What if you get sick?
The work waits without harm. Code lives in your repository from day one, decisions are written down, and the runbook I write from the code lets someone else take over, which is exactly what your system lacks today. No subcontractors; a substitute only if we both agree. Liability cover depends on the engagement; for high‑risk projects, extra cover for that contract is arranged before work starts and reflected in the rate.
How soon can you start?
From 3 November 2026. Book the call and bring the solution file.
What happens when .NET 8 support ends in November 2026?
No security patches after 10 November 2026, the same day as .NET 9. Move to .NET 10, supported until November 2028, and expect breaks such as BinaryFormatter (.NET support policy, breaking change).
Is .NET Framework 4.8 end of life?
It has no date of its own and follows the Windows it runs on (lifecycle FAQ). Older parts do end: 4.6.2 in January 2027 and ASP.NET Core 2.3 on Framework in April 2027 (ASP.NET support policy).
Is our ASP.NET Core app exposed to the 9.4 Kestrel CVE?
On 13 October 2026 Microsoft published CVE‑2026‑88092, request smuggling in Kestrel rated 9.4, affecting .NET 8, 9 and 10. The fixes are in 8.0.32, 9.0.21 and 10.0.13, and self-contained apps stay vulnerable until they are recompiled and redeployed (GitHub advisory). I find every app and package that ships Kestrel, upgrade runtimes and packages in waves you can revert, and redeploy. When React2Shell hit in December 2025, my clients’ apps were patched the same day.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

Why do Java developers wear glasses?Punchline

Because they can’t C#. Ba‑dum‑tss.

What did the .NET Framework 4.8 app say to the new hires?Punchline

“I’ll outlive all of you.” Ba‑dum‑tss.

What do you call a legacy system nobody understands?Punchline

A national heritage site. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

Maintenance & CI/CDUpgrades with a safety net, migrations, GitHub Actions, legacy kept alive.Live demo TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo JavaScriptBrowser and Node.js, with or without a framework, legacy included.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack