Przemysław Zalewski

React in production since 2017

Hire a React developer who proves the feature worked

For product teams whose React app feels slow, whose upgrades keep slipping or whose agent-written pull requests wait in review. I fix the interface, put Playwright tests around it and show on a PostHog dashboard whether users took to it.

Book a free 30‑min call Email me instead

Calls this week · work can start now · Wrocław, Poland (CET), remote

Przemysław Zalewski
2017first React app in production
9years of TypeScript, React and Node.js
~2/3of merged PRs in 2026 built with AI coding agents, nearly all through my review or merge
100,000+players of Korona Krulów, my open-source browser game

Sound familiar?

React problems I fix in 2026

Does our React app have to meet the European Accessibility Act?

Since 28 June 2025 the European Accessibility Act requires e‑commerce platforms, banks and other consumer services in the EU to be accessible (AccessibleEU). A checkout nobody can finish by keyboard is now a legal risk on top of lost orders.

I put WCAG 2.2 AA behind an automated axe gate and test keyboard paths in Playwright on every pull request. A change that breaks checkout by keyboard fails the build instead of reaching your customers. In August 2026 I made a mail app’s whole interface scale from 100 to 200 percent, converting 122 fixed font sizes without changing a pixel at the default size, which met WCAG 1.4.4 and Apple’s Larger Text label.

Still on Create React App and npm audit won’t go quiet?

Create React App is deprecated and stuck on webpack‑dev‑server 4, while the June 2025 fix for CVE‑2025‑30360, which lets a malicious site steal your source code in non-Chromium browsers, shipped only in 5.2.1 (GitHub advisory). Those warnings will never clear on their own.

I move the app to Vite with the same routes and tests, then upgrade the remaining dependencies in waves you can revert. On a typical app that often takes one evening. In November 2023 I replaced a CSS minifier that pulled in over 1,000 packages with a single dependency, which removed about 8,000 net lines of lockfile and produced smaller CSS.

Sound like you? Book a free 30‑min call →

Did the poisoned axios release reach our lockfile?

On 20 April 2026 CISA warned that on 31 March attackers had published axios 1.14.1 and 0.30.4 to npm with a dependency that installs a remote access trojan (CISA). One poisoned install in CI can leak every secret that job can read.

I check your lockfiles and caches against the known bad versions, pin known‑good versions, rotate the tokens with you and switch CI to lockfile-only installs with install scripts off. After that, dependency upgrades run in small waves you can revert. In March 2026, the morning axios was hijacked on npm, I flagged it to the team, confirmed our lockfile held an old release outside the bad versions, checked my own machine, and advised the team to turn off install scripts and hold back fresh installs.

React app feels laggy when users tap on a phone?

The Web Almanac 2025, published in January 2026, found that only 77% of mobile websites reach a good score on INP, Google’s responsiveness metric (HTTP Archive). A button that hangs after a tap looks broken, so people tap again or leave.

I profile the slow interactions on real‑user data from PostHog, fix the components that block the main thread and show you the numbers before and after. In 2026 I moved the per‑tile totals of Sandtime’s reports into the report worker, by estimate about 0.1 to 0.25 seconds of main-thread work per tile, and added a 15‑second safety net that replaces a stuck worker instead of freezing the screen.

Facing one of these? Book a free 30‑min call →

Why me

React without the framework tax

I pick the stack for the product, never for the résumé. Vite and a plain server when that is enough, Next.js when it earns its place, no client framework at all when one HTML stream does the job.

Accessibility that survives every release

WCAG 2.2 AA behind an axe gate, keyboard paths tested in Playwright, text scaling to 200%. In an email client for older users I built, that level held across releases without a manual audit each time.

Every component shows up as a number

PostHog from day one and a tracking plan per feature. The dashboard shows how many users reached the component and how many finished the flow.

Live demo

A component you can edit

Edit the code and press Run. React 19 renders it live in this page, with no bundler and no build step. The Profiler shows each commit and how long it took.

Demo loading…

Tick React.memo, press Re‑render parent and watch the commit count in the Profiler.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

A desktop 3D measurement product rebuilt for the browser, React in 2017

The problem
A US manufacturer of precision instruments had a desktop app for visualizing 3D scans and wanted feature parity in the browser.
What I did
WebGL and three.js for the scans, React for the interface, a .NET backend around the client’s computation library, Stripe billing, visual regression tests, shared team tooling. Measurement charts computed from scratch, no charting library, kept in sync with the 3D view. Work in English across a nine‑hour time difference, with weekly calls.
Result
Feature parity reached. When the client cut the team for budget reasons they chose which engineers to keep and I was one of two.

WebGL React 2017 1 of 2 kept

See also: C# & .NET (legacy)

Patriot Mail: an AI email client through CASA Tier 2 and onto the App Store

The problem
A greenfield AI‑native email client for web, iOS and macOS, built at Sanddev, needed Google’s CASA Tier 2 security assessment before it could read Gmail, and it had to work for older people.
What I did
I was the principal engineer at Sanddev. I wrote the delivery plan, shaped the product vision and treated prompt injection through untrusted email as a design constraint before any model touched a mailbox. CASA and OWASP ASVS controls became a Playwright suite that runs on every pull request. WCAG 2.2 AA sits behind an automated axe gate.
Result
I led CASA Tier 2 to a pass in January 2026, with third-party pentest findings fixed, and led the yearly reassessment, validated in October 2026; the questionnaire turned into a check on every PR. Live on the App Store on iOS and macOS since April 2026. Text scaling to 200% and a calm‑email mode shipped for older users. At that reassessment five items came back for missing evidence; I fixed the code first, then resubmitted updated evidence, and all five were accepted on 27 October.

CASA Tier 2 iOS + macOS WCAG 2.2 AA Open ↗

See also: SaaS & MVP · Mobile & desktop apps

Offer: From an AI‑built MVP to a product people pay for

An AI coding agent as a team member, under enforced rules

The problem
Coding agents write code faster than a team can review it. A team of four wanted the speed without a slop swamp on main.
What I did
I authored the rule set shared by Claude Code and Codex: mechanical checks over written rules, lint and test gates for security, API surface and CSP, agents working on main with hooks, every PR reviewed by a human, AI‑assisted content disclosed as such.
Result
In 2026 about two thirds of merged pull requests across two products were built with coding agents, and nearly all went through my review or merge. I merged 260+ PRs of my own and reviewed 300+ of other engineers’. My commits across those two products went from under 1,000 in 2025 to 7,500+ by October 2026.

~2/3 PRs with agents 300+ reviews 7,500+ commits in 2026

See also: AI & agents · Full‑stack & custom software

Offer: AI engineer for your team (Node.js, LLM agents)

Facing something similar? Book a free call →

Press

Written up elsewhere

Real links, from Windows Phone apps in 2012 to a game in 2020. Online I go by Ciunkos. Some outlets are gone, so those links open an archived copy.

Antyradio“Fight the epidemic as the government and win the Korona Krulów. A satirical game with TVP news bars”“The work of one programmer, who built it literally at night.” Antyradio’s review of the game.Read the archived copy (in Polish) Gazeta Plus“The game »Korona Krulów«. Lead the PiS government and make decisions in a time of plague…”News piece on the game, the day after launch.Read the archived copy (in Polish) Wieści24“…A game about the coronavirus in Poland has appeared online: Korona Krulów”News coverage of the game the day after launch.Read (in Polish) Wykop“Feel like the Chairman and run the country in Korona Krulów: the game is out”Korona Krulów launch day: 698 upvotes and 152 comments.Read (in Polish)

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week React code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Review as a craft

800+ pull requests reviewed on one product since 2018. I review for the product and its reasons. The code comes second.

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Measured, not assumed

PostHog in every project from day one. A tracking plan per feature, and dashboards leadership reads instead of asking me for numbers.

Good to know

React facts that bite during upgrades

propTypes stop warning, silently

React 19 removed propTypes checks and ignores them without a word. defaultProps on function components is gone too, so old prop validation just stops (React 19 upgrade guide).

No more UMD builds

Since React 19 there is no UMD bundle, so a plain script tag pointing at react.js no longer works. React recommends an ESM CDN such as esm.sh (React 19 upgrade guide).

React2Shell without Server Functions

CVE‑2025‑55182 (CVSS 10.0) also hit apps that never wrote a Server Function. Supporting Server Components was enough (React blog, Dec 2025).

The first patches were incomplete

Teams that moved to 19.0.3, 19.1.4 or 19.2.3 had to upgrade again, to 19.0.4, 19.1.5 or 19.2.4. One bug could return Server Function source code, including hard‑coded secrets (React blog).

The Compiler runs on React 17 and 18

React Compiler 1.0 works before React 19 with react‑compiler‑runtime and a target setting. Expo turns it on by default; Vite and Next.js need opt‑in (React Compiler 1.0).

Errors are no longer re-thrown

In React 19, uncaught errors go to window.reportError and caught ones to console.error. Error trackers that relied on the re‑throw can miss them (React 19 upgrade guide).

FAQ

Questions people ask before they book

What does a React developer cost?
$36⁠–⁠54/h excl. VAT, depending on the task. Dedicated work is $7,500 a month on a B2B contract. The full table is on the pricing page.
How soon can you start?
Now. Book the call now and we agree the scope before then, so I start on day one.
Do you work with Next.js?
Yes, with reservations. App Router, Server Components, the lot. If your product is a long‑lived app with a stable API, I will tell you when Next.js is a tax rather than a tool. There is a whole page about it: hire me for Next.js.
How do you test React code?
Playwright for end‑to‑end and visual regression across browsers and devices, axe for accessibility, unit tests where the logic lives. On one project Google’s CASA security controls became a Playwright suite that runs on every pull request.
React Native too?
Shipped to iOS and Android as wrappers for a SaaS and as ad features in a travel app. Native where it pays, web where it does not. More on the mobile and desktop apps page.
Can you take over an existing codebase?
Yes. It starts with the one‑week React codebase audit above: findings ranked by risk, a plan with milestones and a go or no‑go. Then the first pull request.
Do you use AI coding agents?
Yes, under enforced rules: lint and test gates, a human review of every PR, disclosure of AI‑assisted work. In 2026 about two thirds of merged PRs across two products were built with coding agents, and nearly all went through my review or merge. How that works day to day is on the AI and agents page.
Our team already uses Claude Code. What do you add?
Review capacity and rules. In 2026 I merged 260+ pull requests of my own and reviewed 300+ of other engineers’. I put the rules, hooks and CI gates into your repository, so your team’s agents keep working under them after I leave. More on the AI in your company page.
You are one person. What if it fails or you get sick?
Start small: the one‑week audit or one reviewed pull request, both priced before we start. Hourly work has no minimum, so you can stop at any time and keep everything delivered. Code, CI and docs live in your repository from the first commit, the contract transfers the copyright to you in writing, and every project keeps a runbook and architecture notes. If I am ill, you hear it the same day. How I work.
Is my React app affected by React2Shell if I do not use server actions?
Possibly. Any app that supports Server Components was exposed. Safe versions are 19.0.4, 19.1.5, 19.2.4 or later, because the first follow‑up patches were incomplete (React blog).
Do I need React 19 to use the React Compiler?
No. Version 1.0 runs on React 17 and 18 with react‑compiler‑runtime (React Compiler 1.0). Create React App is deprecated, so a move to Vite is usually the first step (React blog).
Does our React app have to meet the European Accessibility Act?
Since 28 June 2025 the European Accessibility Act requires e‑commerce platforms, banks and other consumer services in the EU to be accessible (AccessibleEU). A checkout nobody can finish by keyboard is now a legal risk on top of lost orders. I put WCAG 2.2 AA behind an automated axe gate and test keyboard paths in Playwright on every pull request. A change that breaks checkout by keyboard fails the build instead of reaching your customers. In August 2026 I made a mail app’s whole interface scale from 100 to 200 percent, converting 122 fixed font sizes without changing a pixel at the default size, which met WCAG 1.4.4 and Apple’s Larger Text label.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

Why did the useEffect need therapy?Punchline

It could never get closure. Ba‑dum‑tss.

Why are function components so rude?Punchline

They have no class. Ba‑dum‑tss.

Why was the React component exhausted?Punchline

It re-rendered all night. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work can start now · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

Next.jsApp Router done right, or an honest exit plan.Live demo TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo JavaScriptBrowser and Node.js, with or without a framework, legacy included.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack