buildwithluke
Start a project

Available for new projects

I build the systems businesses run on.

Full-stack developer in Malaysia. I design and ship business platforms, mobile apps and the Linux infrastructure behind them — from the first database table to the production server.

See the workGet in touch

$ whoami

luke — full-stack & systems developer

$ ls ~/shipped

  • IT SUITEsystem
  • Fleet Management Dashboardsystem
  • Asset Management Systemsystem
  • Constituency Service Platformsystem
  • Warehouse Appapp
  • IT SUITE Mobileapp
  • FiveSFLapp
  • Jemputan Digitalapp

$

  • 8Products built
  • 4Business systems
  • 4Apps
  • Code → serverEnd-to-end ownership

Selected work

Systems and apps I’ve built

Most of this work is private client software, so each project is described as a case study rather than linked to source.

SystemWeb platform + Windows agent + desktop app

IT SUITE

One platform to monitor, support and manage a company’s entire IT estate.

  • Device & network monitoring (RMM/NMS) with alert rules
  • IT service desk and configuration database (ITSM & CMDB)
  • Live remote assistance through a self-hosted relay
  • Encrypted password vault with access history
  • PHP 8
  • MySQL
  • Bootstrap 5
  • C# / .NET
SystemWeb dashboard

Fleet Management Dashboard

Every vehicle’s legal and operational status, on one screen.

  • Road tax, permit, inspection & insurance tracking
  • Permit assignment with expiry alerts
  • Pre-journey inspection checklists
  • PHP 8
  • MySQL
  • Bootstrap 5
  • JavaScript
SystemWeb application

Asset Management System

Every IT asset tracked, from purchase to its next service date.

  • Asset & preventive-maintenance register
  • QR labels with public lookup
  • Encrypted per-asset credentials
  • PHP 8
  • MySQL
  • Bootstrap 5
SystemWeb application + public forms

Constituency Service Platform

Casework, public requests and voter records for a constituency office.

  • Public complaint & application forms
  • Complaint tracking for staff
  • Per-staff module permissions
  • PHP 8
  • MySQL
  • Bootstrap 5
AppAndroid app for rugged scanners

Warehouse App

Warehouse receiving, stock location and issuing on a handheld scanner.

  • Goods receiving by barcode scan
  • Bin & stock locator
  • Stock issuing against live inventory
  • Flutter
  • Dart
  • Provider
  • Material 3
AppAndroid & iOS app

IT SUITE Mobile

The IT team’s console in their pocket — tickets, assets, vault and team chat.

  • Tickets with live status
  • Asset lookup by QR scan
  • Face ID / fingerprint sign-in
  • Flutter
  • Dart
  • Firebase
  • PHP API
AppAndroid app for Zebra scanners

FiveSFL

Incoming, store, pick and ship — every warehouse movement scanned, not typed.

  • Scan-to-store and scan-to-pick
  • Hardware scanner integration
  • Pick verification before dispatch
  • Flutter
  • Dart
  • Zebra DataWedge
  • PHP API
AppMobile-first web app

Jemputan Digital

A digital wedding invitation with RSVP, guestbook and a live countdown.

  • Personalised link per guest
  • One-tap RSVP & guestbook
  • Live event countdown
  • Next.js
  • React
  • PHP

Design

Interfaces I’ve designed

Working recreations of real screens from five of my products — web components, a fleet dashboard and three mobile apps. Click, type and filter; they respond like the originals.

Toast notifications

Top-right, auto-dismiss, round close button.

Confirm modal

Blurred backdrop, Esc to close, focus on Cancel.

Data table

Green header, striped rows, status badges, tab filters with counts — filtered client-side.

Asset tagDeviceTypeBranchStatus
ITA-0042ThinkPad T14LaptopHQActive
ITA-0107OptiPlex 7010DesktopPort KlangMaintenance
ITA-0118LaserJet M404PrinterHQActive
ITA-0156FortiGate 60FFirewallJohorActive
ITA-0163Latitude 5420LaptopPenangRetired
ITA-0171TC22 ScannerHandheldJohorMaintenance
Showing 6 of 6

2FA-gated reveal

Masked until a TOTP code is entered, auto-locks after 60s.

Usernamesvc-backup
Password••••••••••••

Loading & empty states

Skeleton shimmer while fetching; a clear next step when empty.

Support tickets
  • TCK/0051Printer offline — Port KlangOpen
  • TCK/0049VPN drops after sleepIn progress
  • TCK/0046New staff laptop setupResolved

Colour tokens

Click a swatch to copy its hex.

Security

Security I build in

These platforms hold credentials, device access and company data, so security is part of the first version — not a later patch. Everything here is implemented in the projects above.

Identity & access

  • TOTP two-factor — mandatory for privileged accounts, self-service for staff
  • Role-based access that keeps developer tools and business data apart
  • Password policy with history, so old passwords can’t be reused

Sessions & login

  • HttpOnly, SameSite session cookies
  • Idle timeout plus an absolute session lifetime
  • Rate limiting and lockouts against brute-force attempts

Data protection

  • AES-256-GCM encryption for stored credentials
  • Secrets revealed only after a fresh 2FA code, then auto-locked
  • Secrets kept out of source control, logs and process arguments

Application security

  • CSRF tokens on every state-changing request
  • Prepared statements for all SQL — no string-built queries
  • Safe upload checks, no shell execution, generic error messages

Audit & detection

  • Tamper-evident audit log using a SHA-256 hash chain
  • Security score and SOC dashboard for failed logins and risky activity
  • Alerts when a device’s firewall, antivirus or disk encryption turns off

Device & agent trust

  • Per-device ECDSA key pairs, with rotation and revocation
  • HMAC-signed commands with nonce-based replay protection
  • Clone detection when a copied device identity reports in

Infrastructure

  • Key-only SSH, host firewall and fail2ban
  • Least-privilege, SFTP-only deploy users — no root deploys
  • HTTPS everywhere and automatic security updates

Testing

  • Automated checks for CSRF, auth guards and unsafe SQL across every endpoint
  • Adversarial testing of my own features before they ship
  • Built-in pentest tooling to probe the app’s own endpoints
Secure by default Least privilege Fail closed Verify, don’t assume

Approach

How I work

  1. 01

    Learn the operation

    I start with how the team works today — the spreadsheets, the workarounds — before deciding what to build.

  2. 02

    Build the whole thing

    Database, backend, interface and any agents or apps around it. One person owning every layer means fewer gaps between them.

  3. 03

    Secure by default

    2FA, role-based access, encrypted secrets and audit trails are part of the first version, not added later.

  4. 04

    Ship and run it

    I set up the server, deploy it and keep it running — Linux, reverse proxies, backups and monitoring included.

Stack

What I build with

Everything here is used in the projects above.

Backend

  • PHP 8
  • REST APIs
  • MySQL / MariaDB
  • Node.js

Frontend

  • React
  • Next.js
  • Vite
  • Bootstrap 5

Mobile

  • Flutter
  • Dart
  • Provider
  • Material 3

Desktop

  • C# / .NET
  • WPF
  • Windows services

Infrastructure

  • Linux
  • Caddy / Apache
  • systemd
  • Docker
  • Cloudflare
  • CI/CD

Security

  • TOTP 2FA
  • Role-based access
  • Encryption at rest
  • Audit trails

Open to projects

Have a system that needs building?

Internal tools, business platforms, mobile apps or a server to run them on — tell me what your team is stuck on.

Email me

Kuala Lumpur · Photo by Muhammad Faiz Zulkeflee on Unsplash