-84E10C?style=flat-square&labelColor=0A0A0A){kind=icon}
{
"name": "Wisnu Alfian Nur Ashar",
"location": "Bekasi, West Java, Indonesia",
"education": "B.IT, President University (GPA 3.54, 2024-2027)",
"role": "Full-Stack Engineer",
"now": [
"Software Engineer Intern @ PT Grahabuana Cikarang (Jababeka)",
"Full Stack Engineer @ Ashar Grosir Parfum (sole engineer)"
],
"focus": ["Production systems", "AI agents", "Security testing"],
"open_to": "Internship / junior roles, collaboration, security research"
}I build and operate systems end to end: requirements, architecture, security, deployment, and the servers behind them. I explain the result clearly to non-technical teams, and I use AI tools such as Claude Code with human review of every output.
Ask me about Laravel · Next.js · Go · PostgreSQL · AI agents & RAG · Cloudflare WAF · Pentest reporting
"Any fool can write code that a computer can understand. Good programmers write code that humans can understand." — Martin Fowler
CYBER — how I test and report
- Scope & recon: agree rules of engagement, map the attack surface.
- Scan & enumerate: Kali Linux toolset and Burp Suite for services, endpoints and misconfigurations.
- Validate: confirm each finding with a safe proof of concept and rate its real impact.
- Report: severity, reproduction steps, evidence, remediation.
- Fix & retest: RBAC, CSP, rate limiting, WAF rules, then verify the hole is closed.
AI — agents in production, not demos
Agents via API with tool-calling, a RAG knowledge base, multi-provider routing with failover, semantic caching, MCP, and approval gates before any action touches the real world.
SOFTWARE — from requirement to release
Domain modelling first, typed code (TypeScript, PHP 8, Go), PostgreSQL with row locking where money and stock are involved, automated tests, and documentation the next engineer can actually use.
DEVOPS — I run what I ship
Linux VPS (Nginx, PM2, Docker), GitHub Actions CI/CD, Cloudflare WAF / Bot Fight Mode / Turnstile, DNS and TLS 1.3, Google Cloud Console, uptime monitoring.
Ashar Grosir Parfum — POS/ERP + e-commerce (Production, sole engineer)
- POS/ERP (Laravel 12, PostgreSQL): millilitre-based stock ledger with row locking (no overselling), shifts, returns, wholesale notes, attendance with selfie + geofence, AI assistant with tool-calling.
- Storefront (Next.js 16, Supabase): PWA + Android APK for wholesale partners, AI chatbot, technical SEO and AI-search visibility.
- Ops: 310K+ requests/month at 99.84% origin reachability and 0.15% 5xx; Cloudflare WAF mitigates 22K+ malicious requests/month.
- Quality: Lighthouse 96+ / 94+ / 98+, 1.34 s average load, 91% "Good" LCP, ~70 automated tests, GitHub Actions CI/CD.
- Automated orders, stock sync and reporting for 100+ daily transactions, cutting reconciliation time 60%.
Laravel Next.js PostgreSQL Supabase Cloudflare Docker Nginx PM2
Wanar AI — personal AI agent platform (Active)
Self-hosted agent platform (~57,000 lines, 200+ commits).
flowchart LR
U[Telegram / WhatsApp / Email / Web] --> G[Access guard + rate limit]
G --> R[Provider router + failover]
R --> P1[Anthropic] & P2[Gemini] & P3[OpenAI-compatible]
R <--> K[RAG knowledge base + semantic cache]
R --> T[Tools: email desk, scheduler, worklog]
T --> A[Approval gate] --> O[Action / reply]
- Routes 15+ AI providers with automatic failover; RAG over source code; semantic caching.
- SSRF protection, approval-gated actions, token-guarded APIs, 47 automated test files.
- Command Center with live FX / economy / tech intel and a nightly self-review that feeds lessons back into prompts.
Node.js React SQLite RAG MCP Playwright
Internal tools @ Grahabuana (Jababeka) (Internship)
- Water Meter Management System: mobile PWA with camera capture, OCR, maps and per-cluster dashboards, replacing paper logs and re-typing.
- Industrial Visit booking platform: Xendit invoicing + webhooks, automatic vouchers, WhatsApp/email notifications, 3 admin roles, audit trail.
- PDF Toolkit: 30 on-device document tools, 87 automated tests, Docker.
ColonyAI — automated plate-count reader (Production)
YOLOv8 pipeline turning agar plate photos into CFU/ml lab reports: 94.1% mAP@0.5, 94.7% precision, 92.5% recall over 56,124 annotated boxes; SHA-256 chained audit trail for ISO 17025.
YOLOv8 FastAPI Next.js PostgreSQL OpenCV
SENTINEL-X — multi-domain threat intelligence (Proof of concept)
Fusion platform correlating Aviation, Maritime, Cyber, Space, Seismic and RF/SIGINT signals with a real-time pipeline (Kafka + TimescaleDB).
FastAPI React PyTorch Kafka TimescaleDB Docker
- Responsible disclosure (2026): reported an NVIDIA infra-controller flaw (BMC admin password exposed via an
ipmitoolargument); validated and fixed within 48 hours. - Penetration testing and vulnerability scanning with Kali Linux and Burp Suite, delivered as structured reports.
- OWASP Foundation member; open-source contributions to NASA and Microsoft projects.
