NC
Backend & Infrastructure&Security Engineer.

Portfolio

  1. 01 About
  2. 02 Experience
  3. 03 Projects
  4. 04 CTFs
  5. 05 Contact

Naveen Chander.Chennai, India · 2026

Portfolio Naveen Chander00
About Me01 / 05

Hello There, It’s Me

Naveen Chander

I Build Backend Systems And Break Them On Purpose.

I’m a Computer Science & Engineering (Cyber Security) student at Shiv Nadar University, Chennai. I spend my time on the parts of software most people don’t see — multi-tenant backends, reverse proxies, sandboxing, and the infrastructure that holds it together. The security half of my degree means I tend to look at my own systems the way an attacker would.

Email naveenmoxx@gmail.comBased in Chennai, IndiaGitHub naveenchander30
Portfolio Naveen Chander01
What I Do02 / 05

What I Build
Every Day?

I spend my days building backends and the infrastructure under them. Somewhere along the way it stopped being coursework and became the thing I actually want to do. There’s something about a system that holds up under load — and finding the one place it doesn’t — that keeps me going.

Portfolio Naveen Chander02
Toolkit03 / 05

What Helps Me
Ship It?

Most of my work happens in Go and TypeScript, with Python for anything data-shaped. PostgreSQL and Redis behind it, Docker around it, and Burp Suite, Wireshark and Ghidra when I need to see what something is really doing.

Portfolio Naveen Chander03
Contents04 / 05

What You’ll
Find Here?

Portfolio Naveen Chander04

Experience.

Portfolio Naveen Chander05
Experience01 / 02

SandBox
Labs

A white-label, multi-tenant college ERP — one codebase serving many institutions, each with its own database and app instance.

Role
Software Engineering Intern
Year
2026 — Present
  • NestJS
  • Next.js
  • PostgreSQL
  • MikroORM
  • Nx
  • CASL
  • NestJS API, Next.js web, PostgreSQL and MikroORM in an Nx monorepo.
  • Per-tenant database and app instance, so one codebase satisfies DPDP data-residency and NAAC audit rules.
  • Authorization centralized in a single CASL check plus a default-on RBAC row filter applied per request — feature modules cannot forget to scope a query.
  • Four modules communicating only through typed contracts, with Nx boundary rules failing CI on any violation.
Portfolio Naveen Chander06
Experience02 / 02

Qualian
Technologies

Vanguard — a self-hosted Wi-Fi spectrum analyzer that scores channel congestion from passive 802.11 telemetry and turns it into a channel plan.

Role
Network Security Intern
Year
2026
  • Fastify
  • TypeScript
  • Prisma
  • SQLite
  • React
  • Recharts
  • Kismet

github.com/naveenchander30/Vanguard

  • One authenticated request per cycle to Kismet's device view derives everything: AP RF telemetry, per-AP active client counts, and a persisted snapshot.
  • Client counts come from 802.11 association data (`last_bssid`) rather than SNMP polling — nothing has to be enrolled to be measured.
  • Collector in Fastify and TypeScript writing per-client and per-channel rows to SQLite (Prisma, WAL) every cycle, so congestion has history.
  • Scoring engine weighs co-channel, adjacent-channel, utilization and client load into a 0–100 score, surfaced as a channel plan across a 7-AP fleet.
  • Pentested internal networks alongside it with Wireshark, Burp Suite and Metasploit.
Vanguard dashboard: congestion scores per channel, severity distribution bar, and a scored bar chart across 2.4 and 5 GHz channels.
Congestion scoring — worst channel surfaced first
Vanguard channels view: per-channel cards grouped by band showing office APs, interfering APs, client counts, utilization bars and recommended channels.
Per-channel occupancy, with the recommended plan marked
Portfolio Naveen Chander07

Projects.

Portfolio Naveen Chander08
Selected Work01 / 03

Yxorp

A reverse proxy and web application firewall written in Go, on a stdlib-only data path.

Role
Solo — Go, Prometheus
Year
2025
  • Go
  • net/http
  • Prometheus
  • Grafana
  • Docker

github.com/naveenchander30/yxorp

  • Round-robin balancing across health-checked backends, with no third-party proxy library on the request path.
  • Per-backend circuit breakers that self-heal through half-open probes, so one dead backend is isolated instead of taking the pool down.
  • Per-IP token bucket limiter and streaming body-size limits (`MaxBytesReader`) that reject oversized uploads before they are buffered.
  • 39 rules covering SQLi, XSS, traversal, SSRF, XXE, deserialization and more, plus 15 blocked scanner user-agents — hot-reloaded and validated before they replace the live set.
  • Metrics exported to Prometheus with a Grafana stack, and a dashboard SPA embedded in the binary with zero CDN dependencies.
Yxorp dashboard: requests per second, blocked request count, latency, uptime, component health grid, live request traffic chart and an event log.
Live traffic, blocked requests and per-request event log
Yxorp backends view: three backend cards, two online with closed circuit breakers and one offline with an open circuit breaker after five failures.
One backend killed mid-run — its breaker trips open, the pool keeps serving
Portfolio Naveen Chander09
Selected Work02 / 03

Policy
Desk

An insurance agency management platform — web dashboard and mobile app on a single backend.

Role
Solo — Next.js, Expo, Supabase
Year
2026
  • Next.js 16
  • Expo 56
  • Supabase
  • React Native Paper
  • Vitest
  • Playwright

web app

  • Next.js 16 App Router dashboard and an Expo 56 React Native app sharing one Supabase Postgres backend and one auth model.
  • Clients, policies, insurance types and payments modelled as linked records, with status filters and a mark-as-paid action.
  • One-click WhatsApp reminder dispatcher over pending-payment records, with retry and send logging — cutting manual follow-ups.
  • Tested with Vitest, RNTL and Playwright across both surfaces.
PolicyDesk dashboard: counters for clients, policies, pending payments, overdue payments and paid this month, plus a WhatsApp payment reminder action.
Agency dashboard — the reminder dispatcher lives here
PolicyDesk payments table listing client, insurance type, amount due, amount paid, due date and pending, overdue or paid status badges.
Payment ledger with pending / overdue / paid states
Portfolio Naveen Chander10
Selected Work03 / 03

MuSync

A self-hosted playlist synchronization engine moving tracks between Spotify and YouTube Music.

Role
Solo — Python, Celery, React
Year
2025
  • Flask
  • Celery
  • Redis
  • PostgreSQL
  • React
  • Docker

github.com/naveenchander30/MuSync

  • Flask and React over Celery and Redis, so a sync is a detached background job the UI can watch rather than a request that has to finish.
  • Hybrid matcher: weighted RapidFuzz scoring on title, artist and duration, backed by average-hash comparison of album art when the text is ambiguous.
  • Low-confidence matches route to a review queue with ranked candidates instead of guessing; checkpoints let a failed sync resume where it stopped.
  • Redis sorted-set sliding-window rate limiter with an in-memory fallback, so parallel workers never trip the upstream APIs together.
  • Ships as one Docker build that runs Alembic migrations and starts a worker on boot.
MuSync dashboard: an in-progress sync banner with track-level status, self-hosted instance health, sync counters and a sync history list.
Sync in progress, track by track, with per-job history
Portfolio Naveen Chander11
Competitive Security05 / 05

Where I Test
Myself?

Shiv Nadar University, Chennai — B.Tech Computer Science & Engineering (Cyber Security) · Aug 2024 – Jul 2028 · CGPA 8.98/10 · NSO Volunteer (80+ hrs) · POC Coding Club

Portfolio Naveen Chander12
Get In Touch

Let’s build
something.

© 2026 Naveen Chander13