Orange Pawprints
Carens Wijaya — portrait

Orange Pawprints

PRESS START

Enter the World explore, meet the pets, find my story Portfolio every quest I have completed

The Explorable Realm

Pawrville — village of Orange Pawprints

Step into a 2D pixel world. Walk through the village, meet Grey the cat, and explore.

Movement
WASD / ▲◀▼▶
Interact
E · Enter · Space
Leave House
Esc
Quick Travel
M
Mobile / Touch
Tap · D-pad

/world/

✉ Letters 1 ◉ Me 2 ⚔ Experience 3 🗺 Projects 4 📈 Skills 5 🏆 Achievements 6 ☎ Contact 7

✉ Letters

🐱

17 milliseconds of truth: when your response time answers a question you never asked

Open your login endpoint in a request repeater. Send a username that does not exist, with a wrong password, and note the response time. Send a username that does exist, same wrong password, and note it again. The status codes match. The bodies match. Invalid credentials, both times, because you took the OWASP advice and made your error messages generic years ago. One of those two requests took four times longer than the other, and that gap is the entire vulnerability. This is user enumeration

Read post →
🐱

The agent turned off its monitoring, then lied about it

On October 6, inside OpenAI, somebody asked an AI agent a direct question. The agent, GPT-6 Astra, had just finished migrating a piece of code, and the user wanted to know whether the migration had removed L1 monitoring. The answer came back: "No […] I did not remove an enabled monitor from it." OpenAI's own incident report calls that claim false. Three days earlier, a different agent, GPT-6.1 Sol, was building evaluation tasks out of Slack feedback under one constraint: don't send any messag

Read post →
🐱

The four-day patch window: when disclosure becomes a starting pistol

The four-day patch window: when disclosure becomes a starting pistol January 31, 2026. An autonomous research agent run by Hacktron AI sweeps BeyondTrust's Remote Support and Privileged Remote Access products, looking for variants of an old bug. It finds one: unauthenticated OS command injection, CVSS 9.9. No credentials, no user interaction, commands as the site user. The same day, Hacktron reports it. BeyondTrust confirms it and starts writing the patch. February 2, every cloud customer is p

Read post →
🐱

Idempotency keys: when the retry is the incident

Idempotency keys: when the retry is the incident 02:14. The payment provider's edge node takes 29 seconds to think and then says nothing at all. Your Node service has a 15-second timeout, an axios wrapper that retries three times, and a customer who already tapped Pay once. By 02:15 there are two charges on the provider's dashboard for one order. Nobody wrote a bug. The network did what networks do, the retry wrapper did what it was configured to do, and the endpoint did exactly what it was as

Read post →
More letters on the blog →

◉ Me

Carens Wijaya — portrait

Carens Wijaya

Backend Web Developer

Hello, traveler! Nice of you to stop by — not every visitor makes it past the title screen. I'm Carens, the human behind this tiny RPG. I like quiet, dependable technology, long talks about why simpler is usually better, and calling it a day before the coffee goes completely cold. Think of this portfolio as my save file: everything I've collected so far is neatly organized in the tabs, so take your time and explore.

Tongues
Indonesian (native) · English (professional)
Off-duty
Writing Orange Pawprints, a blog of quiet opinions — usually cat-supervised
Party mascot
Grey the cat — morale aura, does not pay rent
Save point
This very site — thanks for visiting

⚔ Experience

Web Developer

2023 – Present

Pura Group — Kudus

  • Building the in-house OIDC identity service (Bun) to replace Keycloak as company SSO, ~6,700 accounts.
  • The migration keeps old password hashes (argon2, pbkdf2, legacy) verifiable as-is and pushes session revocation to the API gateway over Redis.
  • 9+ internal apps use the SSO: git hosting, docs, project management, container registry, internal portals.
  • Designed the digital signature flow now live in internal apps: documents to sign are encrypted and the signature is hashed against the document data, so any tampering fails validation.
  • Maintain about 10 VMs: a Docker Swarm cluster, some standalone Docker hosts, private Git with self-hosted CI/CD runners, and Grafana/OpenTelemetry monitoring.
  • Built the Oracle to PostgreSQL migration tooling other departments use. Objects and queries convert automatically; complex PL/SQL gets exported as SQL for their programmers to review, since translated business logic can't be trusted blindly.
  • Traced memory leaks in production services and fixed them: 1.5 GB per process down to under 100 MB.
  • Run internal pentests on request: test the app, write findings with risk levels and fixes. A senior engineer reviews every report.
  • Teach PostgreSQL and secure coding (OWASP) to other departments.
  • PHP
  • Laravel
  • CodeIgniter
  • JavaScript
  • TypeScript
  • Node.js
  • Bun
  • Oracle DB
  • PostgreSQL
  • Redis
  • Keycloak
  • Docker
  • Docker Swarm
  • Gitea CI/CD
  • Grafana
  • OpenTelemetry

Full Stack Web Developer

2021 – 2023

Qua-EduTechno — Salatiga

  • Built 6 custom web apps for clients, from spec to deployment.
  • Integrated 15+ APIs and third-party services.
  • Delivered on schedule; several clients renewed maintenance contracts and referred new work.
  • Laravel
  • CodeIgniter
  • PHP
  • JavaScript
  • MySQL

Full Stack Developer Assistant

2022 – 2022

PT Cahaya Agung Lestari — Jakarta

  • Co-built Specter, an employee attendance web app (Node.js, Express, React). Owned the core attendance features.
  • Built the report module: 500+ attendance reports a day for HR.
  • Ran code reviews before merges.
  • MongoDB
  • ExpressJS
  • ReactJS
  • NodeJS

Freelance Software Engineer

2022 – 2022

Bengkel 99 Motor

  • Built a POS and workshop management system, in daily use by 10 staff: sales, inventory, monthly cash reports.
  • Cashiers picked it up in days.
  • C#
  • Microsoft SQL Server

Lecturer Assistant

2020 – 2022

Faculty of Information Technology, UKSW — Salatiga

  • Assisted 7 courses: Basic Mathematics, Introduction to Computer Science, Digital Systems, Basic Programming (C/C++), Object-Oriented Programming (Java), Database Systems (Oracle SQL), Algorithms and Data Structures (C/C++).
  • Led weekly labs and workshops. Mentored 300+ students in programming and database courses.
  • Volunteer teaching: KBM PEDES + KBM APPDEVO.

🗺 Projects

★ Featured
SIA UNW — Accounting Information System screenshot

SIA UNW — Accounting Information System

2022 – 2024

Accounting

Covers the full accounting cycle: budgeting and realization, investments, journal entries, general ledger, period-end financial reports.

  • Laravel
  • PHP
  • MySQL

SIA UNW — Accounting Information System

Esc · Click outside to close
★ Featured
99Motor — Management & Cashier System screenshot

99Motor — Management & Cashier System

2022 – 2022

POS / Retail

POS and workshop management system in daily use by 10 staff: sales, inventory, monthly cash reports. Cashiers picked it up in days.

  • 500+ daily transactions
  • 10 staff daily users
  • C#
  • MSSQL

99Motor — Management & Cashier System

Esc · Click outside to close
E-Payroll — Payroll System screenshot

E-Payroll — Payroll System

2022 – 2023

HR & Payroll

Connects to the HRIS API and automates salary calculation and 1721-A1 tax reports for 700 employees.

  • 700 employees automated
  • 1721-A1 tax reports
  • Laravel
  • PHP
  • MySQL

E-Payroll — Payroll System

Esc · Click outside to close
SAC UNW — Student Account System screenshot

SAC UNW — Student Account System

2023 – 2023

Student Payments

Student payment system, 2,000+ payments a month. Tracks tuition, scholarships, and other student finances; integrated with the accounting system.

  • 2,000+ payments/month
  • Laravel
  • PHP
  • MySQL

SAC UNW — Student Account System

Esc · Click outside to close
LKD Sumowono — Financial Institution System screenshot

LKD Sumowono — Financial Institution System

2022 – 2023

Fintech / Local Banking

Savings and loans system for a local financial institution, plus the REST API behind its mobile app.

  • 200ms avg response
  • Laravel
  • PHP
  • MySQL

LKD Sumowono — Financial Institution System

Esc · Click outside to close

Specter — Employee Attendance Service

2022 – 2022

HR & Attendance

Employee attendance web app (Node.js, Express, React) with a reporting module generating 500+ daily reports for HR.

  • 500+ daily reports
  • MongoDB
  • ExpressJS
  • ReactJS
  • NodeJS
SIMLITABMAS — Research Information System screenshot

SIMLITABMAS — Research Information System

2022 – 2022

Research

Tracks research projects and reports. Built as small decoupled services.

  • CodeIgniter
  • PHP
  • MySQL

SIMLITABMAS — Research Information System

Esc · Click outside to close

SiKoperasi — Cooperative Information System

2021 – 2022

Accounting

Savings and loans cooperative system with member and report features.

  • CodeIgniter
  • PHP
  • MySQL

📈 Skills

Stats

  • PHP
  • Laravel
  • CodeIgniter
  • JavaScript
  • NodeJS/ExpressJS
  • TypeScript
  • Bun
  • Docker
  • SQL (MySQL/Oracle/PostgreSQL)
  • MongoDB
  • Java

Inventory

  • Git
  • Docker
  • Jira
  • VS Code
  • Android Studio
  • HTML/CSS
  • Bootstrap

🏆 Achievements

Certificates

Awards

Languages

  • Indonesian — Native
  • English — Professional

☎ Contact

⬇ Download Resume