Prototype mode — practice content, not a real service yet

Software Developer

Cybersecurity

Javier
Rojas

> Writing code was never the hard part.
Deciding, planning, delegating, reviewing and verifying: that's where it gets hard.

Software built with care, where good practices and testing aren't an afterthought.

View Projects Contact

> About

~/about.ts

I'm a software developer. I've spent about three years building web applications: I started at a startup, moved to a consultancy, and today I work on my own project to stay current with modern development, learning architecture, testing, and agentic coding.

My strength is frontend, especially Vue 3 and React, and I have a good eye for implementing a design exactly as it was intended. I also work in backend with Laravel and NestJS.

Code quality always mattered to me: project structure, making good use of what the framework offers, applying good practices. That was the part I enjoyed most. But day to day, with several projects and tight deadlines, it's usually the first thing that gets sacrificed - it's hard to justify time on something that isn't visible from outside. What changed with AI wasn't my judgment, but the speed. Reviewing my past projects with agents, I found eleven bugs that had made it to production, and I learned something from each one. That review would have taken me weeks before. Today, quality and testing stopped being a luxury of time.

// TECH_STACK

Frontend
Vue.js React TypeScript JavaScript Tailwind CSS HTML/CSS Astro
Backend
Laravel NestJS PostgreSQL MySQL Prisma REST APIs
Quality & architecture
Jest GitHub Actions (CI/CD) Git / Git Flow Scrum / Jira Layered architecture
AI-assisted development
Claude Code Spec-Driven Development LLM agents OpenCode

> Projects

~/vetary
$ git clone vetary
▸ Cloning repository...
▸ Done.

Vetary

Personal project May 2026 - present

A booking system where multiple clinics share the same platform, but each one only sees its own data. Isolation between clinics is centralized in a single point, authentication uses JWT with refresh tokens, and there are 153 tests that run automatically on every push via GitHub Actions. I work with AI agents, but I define the architecture and write the spec before a single line gets touched, and I review everything before merging.

NestJS TypeScript PostgreSQL Prisma React Tailwind CSS Jest
Code
~/coworking-booking-platform
$ git clone coworking-booking-platform
▸ Cloning repository...
▸ Done.

Coworking booking platform

Neering SpA 2023 - 2024

Development of most of the frontend: user accounts, credit purchases, Transbank payments, and room bookings. Vue 3 Composition API with Pinia and TanStack Query, on top of a Laravel REST API.

Vue 3 TypeScript Pinia TanStack Query Laravel
~/crm-from-scratch
$ git clone crm-from-scratch
▸ Cloning repository...
▸ Done.

CRM from scratch

Neering SpA 2023

Complete frontend (login, dashboard, client management) built from Figma designs, consuming a Laravel REST API. Vue 3 and Tailwind CSS.

Vue 3 TypeScript Tailwind CSS Laravel
~/matchbook
$ git clone matchbook
▸ Cloning repository...
▸ Done.

Matchbook

Matchbook Chile SpA 2021 - 2022

Book buying, selling, and trading platform funded by CORFO. Frontend built from scratch with React, JavaScript, and Sass; responsive layout. The current live version differs from the original. Git Flow and Jira.

React JavaScript Sass
Live

> Services

Available for freelance projects and to join a team.

Websites and landing pages

Fast sites that adapt to any screen, with the content you want to show

From $600,000 CLP

Astro Tailwind Vercel Technical SEO

Custom web applications

Applications with their own business logic: admin panels, booking systems, CRMs. Frontend in Vue or React on top of a Laravel or NestJS backend.

From $1,800,000 CLP

Vue 3 React TypeScript Laravel NestJS PostgreSQL
Less competition

Maintenance and evolution of existing projects

I take on already-built projects, even older ones, to fix, improve, or add features without breaking what already works.

$30,000 CLP / hour, monthly hour package

Vue 2 & 3 Laravel Refactoring Migrations

Payments and API integration

Integration with payment gateways and external services: Transbank, REST APIs, purchase and subscription flows.

From $400,000 CLP

Transbank REST API Webhooks

Web performance optimization

If your site loads slowly, I diagnose why and improve load speed: images, render-blocking resources, bundle size. I deliver a report with before-and-after metrics.

From $250,000 CLP

Lighthouse Core Web Vitals Astro Vite
Coming soon

Web security review

Application review looking for common issues: authentication, data isolation between clients, input validation, and information exposure.

To be discussed

Available once I complete the eJPTv2 certification (Dec 2026)

OWASP Authentication Multi-tenancy

> Experience

  1. Colegio Adventista

    Apr 2025 - Feb 2026 (11 months)

    IT Administrator

    Administration and support of the school's technology infrastructure: network, computer lab, and audiovisual equipment. Management of the Lirmi and SIGE educational platforms (enrollment, grades, and academic records) and support for teachers and administrative staff. Photo and video coverage of institutional events, including editing and publishing content on the school's website and social media.

    Lirmi SIGE

  2. Neering SpA

    Mar 2023 - Jun 2024 (1 year 4 months)

    Software Developer

    Software consultancy. I worked mainly on frontend with Vue 3 (Composition API) and Pinia, consuming REST APIs from Laravel backends. I built most of the frontend for a coworking booking platform, where users created accounts, bought credits via Transbank, and booked rooms. On some projects I led the frontend end to end, joining the project manager in client meetings to define scope and technical decisions. I fixed feature issues in a Flutter mobile app and handled publishing it to the App Store and Google Play. I also maintained legacy Vue 2 (Options API) projects, wrote SQL queries, and supported clients.

    Vue 3 Pinia TypeScript Laravel Flutter Vue 2 SQL

  3. Neering SpA

    Jan 2023 - Feb 2023 (2 months)

    University Intern

    I joined as a professional intern. The first weeks were onboarding into Vue, Tailwind, and Laravel, plus fixes on an existing Vue 2 (Options API) application. I then built the frontend for a CRM from scratch with Vue 3 and Tailwind: login, dashboard, and client management, based on mockups from the design team and consuming a Laravel REST API.

    Vue 3 Vue 2 Tailwind CSS Laravel

  4. Universidad Técnica Federico Santa María

    Mar 2022 - Jul 2022 (5 months)

    Teaching Assistant, Web-Oriented Design and Programming

    Teaching assistant for the Web-Oriented Design and Programming course in the IT Technician program, guiding and supporting students in technologies like HTML, CSS, JavaScript, and PHP.

    HTML CSS JavaScript PHP

  5. Matchbook Chile SpA

    Apr 2021 - Jan 2022 (10 months)

    Front-end Developer

    Startup for buying, selling, and trading books, funded by CORFO. I helped build the platform's frontend from scratch with React (functional components and hooks), JavaScript, and Sass, working on responsive views faithful to the design. My first exposure to a professional workflow: Git Flow, pull requests, and Jira.

    React JavaScript Sass

> Testimonials

Photo of María José Pavez Figueroa

"Javier works in a rigorous way, always focused on finding a way to resolve requests from different work areas. Collaboration, empathy, and excellence are some of the concepts that undoubtedly capture his abilities. As a communications professional, I also have to highlight his warmth and willingness to help. Thank you for your support!"

María José Pavez Figueroa

Communications Professional

Via LinkedIn

> Why security

I come from software development, but curiosity about cybersecurity always called to me. I started dedicating real time to it, following my own path (courses, wargames, and practice), while building my projects. Along the way I reviewed code from old projects to improve as a developer, and that's where I ran into security flaws I hadn't seen at the time. That opened up two paths. One is building with the mindset that no one should break what I make, which is now part of how I develop. The other, the one I'm actually pursuing, is pentesting: learning to break things to truly understand how they're protected. I'm just starting down that path, with the eJPTv2 as my first goal.

> Path

  1. Linux customization

    2026

    Done

    Hack4u course. Configuring and customizing the Linux work environment. 3 hours, 14 lessons.

  2. Fundamentals: shell and first challenges

    Jun - Jul 2026

    Done

    OverTheWire Bandit, levels 0 to 13. TryHackMe: Linux Fundamentals Part 1 and the intro to cybersecurity module, with a first look at both sides: offense and defense.

  3. Introduction to Linux

    2026

    In progress

    Hack4u course. SUID and SGID permissions, sticky bit, descriptors, Bash scripting, and Linux networking. 15 hours, 82 lessons. In parallel: the networking fundamentals module on TryHackMe.

  4. Introduction to Hacking

    2026

    Planned

    Hack4u course. The core of pentesting: reconnaissance, enumeration, exploitation, and post-exploitation, following PTES methodology. 53 hours, 124 lessons. Once finished, assess whether there's enough preparation to sit the certification.

  5. eJPTv2 — Junior Penetration Tester

    Dec 2026

    Planned

    INE Security certification with a hands-on exam. Goal: December 2026. After the certification: Web Hacking and Offensive Python.

> Certifications

CSFPC
CertiProf
Apr 2021 - Apr 2023
Expired
Cyber Security Foundation Professional Certificate
eJPTv2
INE Security
goal: Dec 2026
In progress
eLearnSecurity Junior Penetration Tester v2
About the exam →
eCPPTv2
INE Security
2027
Planned
eLearnSecurity Certified Professional Penetration Tester v2
About the exam →
OSCP
Offensive Security
2028
Planned
Offensive Security Certified Professional
About the exam →

> Applied security

Multi-tenant isolation: why the filter belongs in one place

If the tenant filter is repeated in every query, it only takes one to fail for a client to see another client's data. In Vetary I centralized it in the base repository: a single point to audit.

Multi-tenancy NestJS Prisma

Baseline security before the first feature

Rate limiting, security headers, CORS, and password hashing were configured in phase 1, not after there were already users.

NestJS Helmet Rate limiting

JWT with revocable refresh tokens

Short-lived access token and a database-stored refresh token that can be revoked. What problem each piece solves, and why one alone isn't enough.

JWT Authentication Sessions

The risk of not having RLS, and why I documented it

When isolation depends only on the application layer, one failing guard is a data leak. It's conscious technical debt, which is why it's written down.

PostgreSQL RLS Technical debt

> Write-ups

OverTheWire Bandit: levels 0 to 13

Jun - Jul 2026

A walkthrough of the wargame's first thirteen levels. More than the passwords, what stuck were the commands: file, find -exec, strings, tr, xxd -r, base64. And a new habit: dropping cat when a redirection is enough.

Linux Shell CTF OverTheWire

> Contact

Have a project in mind or want to talk tech? Write to me.

GitHub LinkedIn

Privacy