Welcome to my technical product-build portfolio.

I build enterprise-grade prototypes that connect customer success, revenue workflows, compliance governance, data privacy, cloud architecture, and B2B/B2B2C platform design across ASEAN.

A live B2B2C optical commerce MVP combining eyewear e-commerce, family prescription profile management, saved prescription checkout, optometrist-assisted verification, non-diagnostic vision screening, consent controls, audit trails, anonymised distributor demand forecasting, and ASEAN governance tracking across 10 markets.

Built to explore how optical retail can evolve into a trusted, data-conscious, and compliance-ready digital ecosystem.

Live demo: https://m0-0n.com

This architectural blueprint outlines the data segregation and compliance boundaries enforced to safely isolate protected health information (PHI) and personal records across regional ASEAN territories.

To ensure complete boundary separation, the platform decouples business transactions from sensitive user identities:

• Pseudonymized Data Vaults: User identities are automatically replaced with randomized UUID tracking keys at the database ingestion tier.
• Asymmetric Security Management: Cryptographic operations occur strictly within automated Hardware Security Modules (HSMs), preventing internal administrative teams or infrastructure observers from viewing raw unencrypted records.

An enterprise-grade cloud architecture prototype exploring real-time synchronisation pipelines, caching distribution networks, latency reduction workflows, and operational performance visibility.

Built to demonstrate how infrastructure thinking, performance optimisation, and product UX can be translated into a working technical sandbox.

Live demo: https://lovturbo.com

This section outlines the high-performance data engineering and content distribution blueprint engineered to eliminate synchronization bottlenecks and reduce end-to-end user latency.

Client ──► Anycast CDN ──► Intelligent Cache ──► Ingestion Engine ──► Datastore

• Event-Driven Ingestion: Employs a non-blocking asynchronous event loop structure to process incoming payloads without queue blocking, maintaining operational consistency under high-concurrency loads.
• Optimized Payload Serialization: Utilizes compact binary formatting models over standard text serialization to reduce transport packet volumes and accelerate wire-speed network transmission.

• Geographic Proximity Routing: Leverages an Anycast-routed Content Delivery Network (CDN) framework to terminate TCP connections at local regional edge nodes, stripping out propagation delays across ASEAN markets.
• Multi-Tiered Cache Invalidation: Employs an aggressive edge-caching model with deterministic, event-based cache purging to serve high-volume static components instantaneously while preserving database resources.

• Micro-Batch Stream Pipeline: Ingested telemetry strings run through structured micro-batch processing workers before database commit steps, flattening expensive IO storage bottlenecks.
• Connection Multiplexing Layer: Stabilizes communication channels between internal network dependencies by reusing persistent, long-lived sockets, removing the recurrent latency penalties of cryptographic connection handshakes.

An AI model aggregation prototype exploring multi-LLM routing, prompt orchestration, payload handling, token usage visibility, fallback logic, and secure API gateway behaviours.

Built to demonstrate applied AI workflow design and enterprise orchestration patterns.

Live demo: https://aimm.dev/

A cybersecurity workflow prototype simulating digital asset recovery journeys, verification milestones, case intake, evidence tracking, and mobile-responsive recovery-status flows.

Built as a security infrastructure case study to explore trust, auditability, user guidance, and structured incident-response UX.

Live demo: https://orecover.com

A Singapore-focused foodcourt and coffee shop operations prototype built to simulate multi-vendor stall management, customer ordering journeys, menu visibility, and merchant-side workflow coordination.

The build explores how traditional neighbourhood F&B environments can be translated into a digital operating layer, supporting stall discovery, product/menu browsing, vendor participation, order flow visibility, and basic management logic.

Built as a product architecture sandbox to demonstrate local-market UX thinking, multi-tenant platform design, and operational workflow mapping for Singapore’s foodcourt and coffee shop ecosystem.

Live demo: https://blingfen.com/

A Singapore-focused digital storefront prototype for lucky, memorable, and premium-style mobile numbers.

The build explores niche e-commerce flows around number discovery, product listing, customer enquiry, and culturally relevant buying behaviour linked to auspicious or easy-to-remember mobile numbers.

Built as a product architecture sandbox to demonstrate local-market commerce thinking, lightweight marketplace design, product listing UX, and conversion-focused customer journey mapping.

Live demo: https://dylmn.shop/

A compensation intelligence and salary estimation prototype built to explore how professionals can benchmark role value, compensation expectations, seniority positioning, and market-fit signals through a clean self-service experience.

The build simulates a LinkedIn-style salary discovery workflow, combining role-based inputs, market benchmarking concepts, professional positioning, and data-informed career decision support.

Built as a product architecture sandbox to demonstrate HRTech product thinking, career intelligence UX, compensation benchmarking flows, and marketplace-style professional data experiences.

Live demo: https://founddao.com/

A mobile-first B2B2C running performance commerce prototype combining treadmill bio-burn calibration, multi-profile household tracking, nutrition and recovery insights, simulated voice authentication, simulated eKYC, consent controls, partner-safe analytics, product recommendations, and distributor demand forecasting.

The build explores how consumer training behaviour can become consent-approved aggregate demand intelligence for gyms, wellness retailers, wholesalers, and ASEAN distributors, while keeping identity, privacy, and profile-level consent central to the experience.

Built as a product architecture sandbox to demonstrate AI-native workflow design, privacy-aware B2B2C commerce thinking, subscription packaging, and regional distributor planning logic.

Live demo: https://run0n.com/

This section details the telemetry aggregation frameworks and architectural boundaries engineered to transform real-time consumer training habits into scalable B2B distributor planning metrics.

Biometric Edge ──► Calibration Engine ──► Aggregation Tier ──► Demand Intelligence Core

• De-Identified Data Pipeline: Strips out sensitive user biomarkers and localized biometric strings directly at the edge layer, transmitting only normalized, structural fitness data packets to the cloud processing core.
• Deterministic Calibration Analysis: Feeds multi-profile activity data logs through a localized aggregation index to isolate true demand habits from transient user anomalies.

• Predictive Wholesale Planning: Compiles anonymous user engagement habits into unified market signals, allowing wholesale networks to anticipate inventory cycles without revealing identity parameters.
• Consent-Driven Value Mapping: Restricts corporate access boundaries to aggregate operational performance indexes, ensuring raw consumer identities remain secure behind localized authorization walls.

This repository includes a production-ready, sanitized cloud architecture blueprint designed with a security-first approach to infrastructure management. By separating environment definitions and utilizing immutable infrastructure practices, the setup eliminates common compliance and security configuration risks.

Located in the /terraform directory, the configuration builds an isolated network footprint on AWS using industry-standard security principles:

• Network Isolation: provisions a dedicated Amazon VPC (10.0.0.0/16) to decouple core application workloads from default networks.
• Tiered Subnets: maps out structured public subnets (10.0.1.0/24) inside strict availability zones to enforce clean routing boundaries.
• Minimalist Security Posture: enforces a strict AWS Security Group that blocks non-essential protocol access, allowing entry only via encrypted HTTPS (Port 443) while dropping high-risk open-port configurations.

Located in the /k8s directory, the manifest defines an immutable pod specification designed to maintain highly resilient runtime application instances:

• Resource Governance: sets explicit CPU/Memory request and limit metrics (256Mi/250m minimums up to 512Mi/500m maximums) to prevent container resource exhaustion and stabilize cluster node footprints.
• Strict Runtime Security: locks down container privilege boundaries natively within the Kubernetes engine:
  • Disables root privileges (runAsNonRoot: true with a designated non-uid-0 user account).
  • Mounting structures run on a static, immutable filesystem layer (readOnlyRootFilesystem: true).
  • Explicitly drops system runtime execution elevations (allowPrivilegeEscalation: false).

This section details the micro-segmentation, traffic flow topology, and perimeter security layers implemented across the production environment footprint.

                  [ INTERNET ]
                       │  
                       ▼ (Port 443 | HTTPS)
           ┌───────────────────────┐
           │  AWS Security Group   │ (Denies non-443/ingress traffic)
           └───────────┬───────────┘
                       │
                       ▼ (Forwarded to Cluster Boundary)
           ┌───────────────────────┐
           │    Public Subnet      │ (10.0.1.0/24 inside AWS VPC)
           │ ┌───────────────────┐ │
           │ │ Kubernetes Pod    │ │ (Privilege-escalation disabled)
           │ │ ┌───────────────┐ │ │
           │ │ │ Nginx Core    │ │ │ (Runs as Non-Root UID 10001)
           │ │ └───────────────┘ │ │
           │ └───────────────────┘ │
           └───────────────────────┘

Traffic ingress follows a strict, zero-trust perimeter model:

• Protocol Restraints: The stateless external network boundary terminates all incoming consumer connections directly at the AWS Security Group interface, dropping any traffic not explicitly mapped to TCP Port 443 (HTTPS).
• Distributed DoS Mitigation: By dropping raw arbitrary handshakes, the firewall layer insulates internal container engines from high-volume Layer 4 connection floods.

Workloads execute within a micro-segmented network fabric topology:

• Address Spacing: Infrastructure workloads reside in a software-defined Virtual Private Cloud (VPC) spanning a /16 CIDR block (10.0.0.0/16), creating 65,536 private IP addresses to eliminate multi-tenant network bleeding.
• Zonal Subnetting: Virtual network routing paths isolate edge computing layers inside a public subnet wrapper (10.0.1.0/24), ensuring deterministic routing tables and strict segregation from internal database or storage grids.

Once a payload traverses the edge routing tier, secure compute boundaries protect execution frames inside the Kubernetes pod:

• Filesystem Inmutability: The target web application container leverages an ephemeral Linux kernel configuration where the root system partition is mounted as read-only (readOnlyRootFilesystem: true). Malicious payloads cannot execute automated file writes or runtime configuration injections to persist within the environment.
• UID Context Isolation: The execution daemon explicitly drops the default root administrative namespace context, running under an unprivileged user identity space (runAsUser: 10001). Even in a theoretical container breakout event, the underlying host kernel remains safe from privilege escalation attacks.

Some source repositories are kept private where projects involve security workflows, compliance logic, data governance, or commercial product architecture. Live demos and case-study summaries are provided for portfolio review.