End-to-end DevSecOps platform with 5 core security modules (App, DAST, Mobile, Infra, Container Security), RBAC auth, AI-powered summaries, and automated reporting — rebranded from I3GIS to ClearAnts (clearants.io), now serving 100+ organizations across 1,000+ projects in banking & pharmaceuticals.

• — Lead frontend — ~640 of 900+ commits across 5 security modules with distinct dashboards & workflows
• — Report generation re-architected to NestJS + Puppeteer — 60–80% faster
• — AI chat & summary service connecting to Claude, ChatGPT & DeepSeek via WebSocket
• — Playwright automation running daily at 7AM with Discord alerts
• — Kafka pipeline centralising DevSecOps JSON into ClickHouse
• — Migrating services from Docker Compose to K3s
• — ServiceNow & Jira ticketing integration for security issues

Rendering security reports with heavy sunburst/radar charts directly in the ClearAnts (I3GIS) dashboard was crashing the browser tab. Designed and built a dedicated headless-rendering microservice to fix it — architected and owned solo, in continuous development for 2+ years (300+ commits).

• — Split into two services: a lightweight React app that renders report pages in isolation, and a NestJS orchestrator driving a headless Puppeteer browser to screenshot them into PDF
• — Covers all 5 report types (AppSec, DAST, Mobile, Infra, Container) in both executive and technical variants
• — Multi-module reports merged into a single PDF via pdf-lib / pdf-merge, with jsPDF-autotable as a fallback path for tabular exports
• — Cut report generation from 5–8 minutes to 1–2 minutes (60–80% faster) while eliminating the UI lag and crashes of the old in-dashboard approach
• — Structured, step-by-step logging with per-request process IDs for tracing the auth → fetch → render → PDF pipeline, with automatic sanitization of sensitive fields
• — Deployed as an independent service with its own Jenkins build/versioning pipelines and Docker/K3s targets, decoupled from the main dashboard's release cycle

Standalone NestJS microservice powering AI features across ClearAnts (I3GIS): executive/technical result summaries and real-time chat over multiple LLM providers. Own repo and deploy pipeline — authored 95 of 151 commits over ~4 months of active development.

• — Multi-provider LLM abstraction (Anthropic, OpenAI, DeepSeek) with per-provider pricing tracking and graceful handling of exhausted credit/quota (402) errors
• — AI-generated executive and technical insights across all security modules (AppSec, DAST, Container, Mobile, ASOC), each with dedicated, iteratively-tuned prompts and JSON response validation
• — Real-time chat over raw WebSocket (NestJS + ws), authenticated by validating JWTs issued by the main ClearAnts/I3GIS platform — no separate login, shared auth boundary
• — Built a retrieval pipeline (OpenAI embeddings + GitBook reindexing) to ground chatbot answers in ClearAnts/I3GIS product documentation
• — Persistent Redis caching for generated insights to avoid re-computation, plus request-level rate limiting
• — Deployed as an independent service with its own Jenkins versioning pipeline and Docker build, decoupled from the main dashboard's release cycle

Playwright end-to-end test suite covering ClearAnts (I3GIS) across all 5 security modules — Dockerized, driven by Jenkins CI, and run on a daily schedule with results posted straight to Discord so regressions get caught before users do.

• — E2E coverage spans Application, Dynamic (DAST), Container, Infrastructure & Mobile Security modules plus the report-download flow
• — Env-driven test scoping (TEST_COVERAGE) — run the full suite or target a single module for faster CI feedback
• — Custom Playwright reporter logging step-by-step pass/fail for clearer CI output, with trace capture on retry
• — Dockerized runner that also serves the generated HTML report over HTTP for quick post-run inspection
• — Scheduled daily run wired into Discord for automated pass/fail alerts, no manual report-checking needed
• — Jenkins pipeline builds, tags, and pushes the runner image to the private registry per release

Admin panel for managing ClearAnts (I3GIS) customer licenses — modules entitled, server counts, upgrade history, and PDF license certificate generation. Co-built with the platform team: authored ~57% of 172 commits over ~2.5 years.

• — Customer & license management — per-customer sector/graph views, license detail with active modules, server counts, and upgrade history
• — On-demand PDF license certificate generation via iframe + html2canvas/jsPDF export
• — NextAuth + JWT auth with refresh-token flow, middleware-protected routes
• — Role-based user admin management
• — Jenkins CI across 3 pipelines (build/prod/versioning) with Discord build notifications
• — Dockerized deployment

GitOps-managed 3-node K3s high-availability cluster running ClearAnts' security-scanning microservices (SCA, misconfig, container security, secret-check, infra-security) — Kustomize base/overlays deployed via ArgoCD across dev and prod. Majority contributor: ~56% of 54 commits.

• — 3-node HA cluster over Tailscale VPN with NFS-backed shared storage — RWX for multi-replica scan services, RWO for stateful DBs (MongoDB, Postgres, Redis, MinIO)
• — Fast-failover tolerations (~30s vs Kubernetes' 5min default) plus podAntiAffinity spreading replicas across nodes
• — Kustomize base + dev/prod overlays deployed via ArgoCD
• — Migrated multiple DevSecOps modules off Docker Compose onto the cluster: SCA, misconfig, container-security, secret-check, infra-security, and report services
• — Traefik ingress with per-service path-stripping middleware, plus NodePort services for direct access
• — Also contributed 69 of 248 commits to jenkins-libraries — the team's shared Jenkins pipeline steps used across the whole DevSecOps Toolbox CI

Automated system catching version drift between DEV and PROD across ClearAnts' 5+ client deployments (MCG, Kalbe, Mega, Cloudeka, Lintas Dev) — inspects running Docker containers over SSH, tracks versions in Google Sheets, and alerts DevOps/RnD via Discord + email whenever PROD falls behind.

• — Python collector (Paramiko + Docker SDK) SSHes into each client server and inventories running service versions & deploy dates
• — Synced to Google Sheets (gspread + service account) as the shared source of truth, one dated sheet per collection run
• — PM2-managed cron job runs the collector unattended every 3 days on the deploy server
• — Google Apps Script compares the latest DEV vs PROD sheet, flagging services behind schedule and services missing entirely from PROD
• — Discord alert with role mentions for DevOps/Developer teams, plus a detailed HTML email report — or a green all-clear ping when nothing's outstanding
• — Header-driven column mapping (not fixed indices) so the reminder script tolerates sheet layout changes

Comprehensive internal ERP built from scratch — covering approvals, sales pipeline, rebate, targets, claims, leave, timesheets, KPI, performance assessment, training, and more. Lead frontend contributor: 55% of 560+ commits over 2.5 years.

• — Authored 55% of all commits (560+) — from initial scaffold to production
• — Foundation architecture: RBAC for 10+ roles, module structure, admin console
• — Unified approval center consolidating 6+ queues into one screen
• — Modern polished UI — major upgrade over the previous app
• — Sales pipeline, rebate & targets management
• — Timesheet, KPI & performance assessment modules
• — Leave, claims & HR automation

Training management platform built end to end solo: Laravel admin panel & REST API (60+ endpoints, Sanctum auth) powering a Flutter mobile app (190+ Dart files) for trainees, community members, and corporate clients.

• — Designed full UI/UX for the mobile training app
• — Promo engine with scheduled auto-expiry (cron) and soft deletes
• — Bulk corporate enrollment with per-employee records & approval workflows
• — i3Code coding-class module — mentors, assignments, multipart submission
• — Pusher + OneSignal notifications with in-app notification center

Full-stack compliance dashboard tracking Ansible infrastructure-hardening results across a hospital network's server units — built end to end solo in ~3 weeks (46 commits), starting from a 2-day proof of concept against a 1-week estimate.

• — CSV ingestion pipeline parsing before/after Ansible hardening scan results per host (OS version, rules checked, pass/fail counts), scoped per unit with duplicate-safe schema constraints
• — Role-based auth (User / Admin / Super Admin) via NextAuth + Prisma + bcrypt, with middleware route protection and session-aware redirects
• — Dashboard with unit- and host-level drill-down plus ApexCharts summaries comparing pass/fail rates before vs after hardening
• — Per-host HTML/CSV report file serving, with safe re-upload handling and cleanup of orphaned files on failed writes
• — API rate limiting (Upstash Redis) protecting upload and auth endpoints from abuse
• — Containerized with Docker and shipped through a dedicated Jenkins versioning pipeline

When COVID-19 made on-site practicum impossible, migrated the university computer lab from an offline-only setup to a fully online access model — enabling 6,000 students to run their lab sessions remotely.

• — Migrated 6000-client lab infrastructure from offline to online during COVID
• — Deployed Apache Guacamole 0.9.8 as Remote Desktop Gateway for remote access
• — Configured NGINX, MariaDB Galera Cluster & Moodle for 6000 concurrent clients
• — Set up Prometheus, Node Exporter & Grafana for real-time monitoring
• — Managed HPE DL120/DL360/DL380 Gen10 servers with RAID 5
• — Enabled students to access lab resources remotely without physical presence