Academic software · BSIT · 2021 to 2026

Coursework and Capstone

The software I built as coursework across four years of my degree. It ranges from early console programs to a final-year capstone, a reporting and response system designed and built for a city disaster response office.

There are nine machine problems here, written in C#, Python, Kotlin, PHP, SQL, and the TypeScript and React stack. They include console tools, desktop and mobile apps, database-driven web apps, and one full IoT build that runs from the hardware to the cloud. The capstone is a larger system: a real-time reporting and response platform for a local government unit, made up of several apps. Every entry below follows the same layout. First a look at the features, then screenshots of the GUI, then the software used, and the hardware where it applies. A final section, separate from the software, logs the technical seminars and workshops I attended for IT180L, each as a short summary with the takeaway I drew from it.

program
BS Information Technology (Cybersecurity)
institution
Mapúa Malayan Colleges Laguna · College of Computer & Information Science
span
First year to fourth year, graduating 2026
catalog
9 machine problems and 1 capstone system (3 apps and a portal)

Machine Problems

These are course requirements from across the program, listed in roughly the order I took them. Some were solo projects and some were team finals, written in five different languages. Each one was built and defended for a specific subject.

Cryptography

Multi-Cipher Console Program

IT129 · Information Assurance & Security· C# (.NET console)· Team
Discussion of the features

A menu-driven cryptography suite. It carries several classic ciphers written from scratch, plus one cipher the team designed itself, all built on a small reusable console menu framework. The framework (Menu and Choice) links each menu item to a label, a key, and a function. That keeps the interface separate from the algorithms, so a new cipher can be added without changing the menu code.

  • Caesar cipher: a letter shift by a number you choose, with encrypt, decrypt, and info options.
  • Vigenère cipher: a keyword cipher that also prints the full Vigenère reference table.
  • XOR cipher: a repeating-key XOR shown as hex, with the hex parsed back to bytes on decrypt.
  • Meguprazan cipher: the group's own cipher, with matching encrypt and decrypt routines.
  • Reusable menu engine: colored titles, descriptions, and hotkeys drive the whole app.
Screenshots of the GUI
Multi-cipher main menu
Main menu. The console screen listing the ciphers and their hotkeys.
Vigenère menu with an encryption run
Vigenère. The cipher submenu, then a sample message encrypted with a keyword.
Software used
C#.NET ConsoleVisual Studio 2022
Cryptography

Python Cryptography Toolkit

IT190-4P · Cryptography· Python 3· Solo
Discussion of the features

Two related pieces of cryptography coursework: a hand-written classic-cipher tool, and a benchmark that compares modern ciphers. The first part (Lab1.py) is a menu-driven Caesar and polyalphabetic cipher written from scratch. It works across the full printable ASCII range (codepoints 32 to 126, mod 95) and checks the input, handles negative shifts, and validates message length. The second part (FishTacos) moves to library-grade ciphers and measures how fast they run.

  • Ciphers from scratch: Caesar and polyalphabetic encryption across all printable ASCII, not only A to Z.
  • Salsa20 against Blowfish: a stream cipher next to a block cipher (CBC, with manual PKCS-style padding) using PyCryptodome, timed with perf_counter().
  • Test harnesses: several test files, including an interactive one, plus sample data.
  • Input validation: checks on shift range and message length before it runs.
Screenshots of the GUI
Lab1 Caesar/polyalphabetic menu
Lab1. The Caesar and polyalphabetic menu with a sample encryption.
AES, Blowfish and Salsa20 benchmark output
FishTacos. The cipher cascade check, then the AES, Blowfish, and Salsa20 timing results.
Software used
Python 3PyCryptodomeAES-256 (CBC)Salsa20Blowfish (CBC)

Marine Adventures, 2D Shooter

Object-Oriented Programming· C# · WinForms (.NET 4.7.2)· Team · 2023· GitHub ↗
Discussion of the features

A desktop 2D shooter built to practice object-oriented game design. It uses one class per game idea, with real-time collision and spawning, power-ups, a boss enemy, and saved high scores. Character and Environment act as shared base classes, and Player, Enemy (with a Boss version), Bullet, PowerUps, and Obstacles build on them.

  • Real-time gameplay: movement, shooting, collision detection, and enemy spawning on a game loop.
  • Power-ups: Health, Speed, and Attack pickups that change the player during a run.
  • Boss encounter: a separate boss enemy set up apart from the normal waves.
  • Saved progress: game state written to gameSave.txt and high scores added to highScores.txt.
  • Screen flow: a main window, game window, end screen, and high-score screen.
Screenshots of the GUI
Marine Adventures main menu
Main menu. The title screen with New Game, Load, High score, and Exit.
Marine Adventures boss fight
Gameplay. The level 5 boss fight, loaded from a save, with the double-shot power-up active.
Marine Adventures high score screen
High scores. The saved leaderboard after a run, with sample names. Captured under Mono on Linux, so the window controls look different from Windows.
Software used
C#WinForms.NET Framework 4.7.2Visual StudioGit (PR workflow)
Schema design

Resort Management Database

Database design· SQL (T-SQL DDL)· Team
Discussion of the features

A relational schema design for a resort management system. This is a design deliverable (Statements.txt) rather than a running app, and it is unfinished. Departments and Manager are written out with primary keys and a check constraint. Employees breaks off after two columns, so the file is a partial draft rather than a schema that would run.

  • Departments: the role is the primary key, with a CHECK constraint that limits roles to Accountant, Maintenance, or Reception, plus salary range and qualifications.
  • Manager and Employees: Manager is keyed on ManagerID, and Employees carries a ManagedBy column pointing back at it. The link is implied by the column name only. No FOREIGN KEY is declared, and ManagedBy never gets a datatype.
  • Constraints first: keys and checks written directly in the CREATE TABLE code as named CONSTRAINT clauses.
Screenshots of the GUI

This is a database design project with no application GUI. The screenshots below stand in for the schema code and its entity-relationship diagram.

Resort schema ERD
ERD. The Departments, Manager, and Employees tables, drawn from what the schema file declares.
CREATE TABLE DDL
DDL. The T-SQL CREATE statements as the file has them, keys and checks included, Employees left unfinished.
Software used
SQL (T-SQL)SQL Server / SSMSRelational modelling
Mobile · CRUD

Document Management System, “DocuSafe”

IT140P · Web systems & databases· Kotlin · PHP · MySQL· Solo
Discussion of the features

A document manager for personal documents: an Android app in Kotlin and Jetpack Compose on top of a PHP and MySQL backend. It tracks expiry dates, handles user login, and supports full create, read, update, and delete, including the files themselves. Users log in against a users table with password_verify() and bcrypt-hashed passwords. Documents, and the file data, live in a docusafe table as BLOBs. The project grew from an earlier records-only lab into the finished app.

  • Secure login: bcrypt-hashed passwords and prepared statements throughout.
  • File storage: uploads saved as BLOBs and streamed back when requested.
  • Expiry tracking: each document has an expiry date alongside its type and timestamps.
  • Full CRUD and search: add, edit, delete, and search documents per user.
Screenshots of the GUI
DocuSafe login
Login. Sign-in checked against bcrypt-hashed passwords.
DocuSafe document dashboard
Dashboard. Stored documents with their expiry dates, soonest first. Sample data shown.
DocuSafe upload
Upload. Name, type, and expiry date, then the file, which is saved as a BLOB through a prepared insert.
Software used
PHPMySQLXAMPP / ApacheKotlinJetpack ComposeKtorbcrypt
Web

GearShift Auto Rentals, Car-Rental Web App

Web applications· ASP.NET Web Forms · C# · MS Access· Team
Discussion of the features

A group final that builds a full car-rental site: public marketing pages, customer accounts, a car fleet you can browse and book, and an admin back office. It uses classic Web Forms, where each screen is an .aspx page with an .aspx.cs code-behind, grouped by area. Data is stored in a Microsoft Access database.

  • Separate areas by role: Auth (sign-up, login, profile), Fleet, User, Admin, and the public Home area.
  • Browse and book: view the fleet, open a car's details, and schedule a rental.
  • Customer bookings: a view of the customer's own reservations.
  • Admin office: manage every reservation and user account.
  • Access database: GearShiftAutoRentals.accdb, with JSON handled by Newtonsoft.Json.
Screenshots of the GUI
GearShift home page
Home. The public landing page.
GearShift fleet browse
Fleet. The car grid, where each card opens that car's detail page. Sample cars shown.
GearShift booking dialog with start and end dates
Schedule. The booking dialog on a car's detail page, with the rental dates filled in.
GearShift admin bookings with approve and deny buttons
Admin. Every booking with Approve and Deny, and the balance still due. Sample data, captured under Mono on Linux with the Access data moved to SQLite.
Software used
ASP.NET Web FormsC#.NET 4.8.1Microsoft AccessNewtonsoft.JsonVisual Studio

College Events Attendance App

Database Fundamentals · final· Xamarin.Android (C#) · PHP · Oracle· Team· GitHub ↗
Discussion of the features

A native Android app for creating college (CCIS) events and recording attendance. It was the final project for Database Fundamentals, built by a team with a real pull-request workflow and full git history. The Android UI has one Activity per screen. All data access goes through a single DatabaseHander class that calls PHP scripts over HTTP, backed by an Oracle database through OCI8.

  • Event lifecycle: create, edit, and manage events from their own screens.
  • Attendance: record who attended an event, read back through an Oracle view.
  • Native app with an enterprise database: Xamarin.Android talking to Oracle through a PHP layer.
  • Team workflow: merged pull requests with a public history.
Screenshots of the GUI
CCIS login
Login. Sign-in and entry to the app.
CCIS admin home
Admin home. The organizer's home screen with the attendance dashboards.
CCIS create event
Create event. The form for a new CCIS event.
CCIS attendance list with event picker
Attendance. Attendees with their events, picked through the event filter. Sample data from a stand-in for the Oracle backend, rebuilt with .NET for Android to run on Linux.
Software used
Xamarin.Android (C#)MonoAndroid 13.0PHPOracle Database (OCI8)XAMPPVisual Studio 2022
Mobile

Inventory Management App

Mobile application development· Xamarin.Android (C#) · PHP REST · MySQL· Team
Discussion of the features

A native Android inventory app with user accounts, backed by a custom PHP REST API over MySQL. The code keeps the UI and the data cleanly apart: each feature pairs an Activity (the screen) with a Handler (the API call). Inventory is scoped to each user, and item types come from a bundled catalog.

  • Accounts: register and log in against the REST API.
  • Full CRUD: add, update, and delete items, plus search and sort.
  • Activity and Handler design: screens kept separate from the code that calls the API.
  • Per-user data: an itemsTable scoped by owner, with types from an XML catalog (Clothing, Food, Technology, Other).
Screenshots of the GUI
Inventory login screen
Welcome. Login and registration.
Inventory list with search and sort
List. The user's items with search and a type filter. Sample data shown.
Inventory add/update item
Add or update. The item form with a type picker. Rebuilt with .NET for Android to run on Linux.
Software used
Xamarin.Android (C#)MonoAndroid 13.0PHP REST APIMySQLXAMPPVisual Studio
IoT

IoT Monitoring & Control Dashboard

IT155P · IoT / full-stack· Next.js 16 · React 19 · Supabase · Wemos· Team · 2024
Discussion of the features

A prepaid RFID parking-card system with built-in environmental monitoring, and the most recent stack in this set. An RFID-equipped Wemos (ESP8266) reads parking cards, logs each vehicle's entry and exit, and reports temperature and humidity from a DHT sensor. A Next.js dashboard manages the cards, balances, and parking logs, and a mobile client shows the sensor readings and controls an LED on the device. The project has three tiers: PHP endpoints that the microcontroller calls, PHP endpoints for a mobile client, and the Next.js website backed by Supabase.

  • Prepaid cards: issue an RFID card with a random ID and a starting balance, then top it up.
  • Entry and exit billing: parking logs with automatic timestamps and a calculated total.
  • Live sensor data: the device sends DHT temperature and humidity readings to the backend, and the mobile client reads the latest values.
  • LED and switch: the mobile client turns an LED on the device on or off and reads the state of a switch on the device.
  • Management UI: an App Router dashboard with card and log tables (shadcn/ui and TanStack Table) that talks to Supabase directly.
Screenshots of the GUI
IoT dashboard cards and logs
Dashboard. Card holders and parking logs.
Create RFID card
Create card. Issue a prepaid RFID card.
Card balances table
Top-up. The balance list for every issued card. The top-up itself is written by the device endpoint. Sample data shown.
Software used
Next.js 16React 19TypeScriptTailwind CSS v4shadcn/uiTanStack TableSupabase (Postgres)PHPMySQL
Hardware used
Wemos D1 (ESP8266)RFID reader (RC522)RFID cardsDHT temp/humidity sensorLEDRelay / switch module

Capstone Project

Community-Based Reporting & Response System

A community-based reporting and response system with geotagging for City Disaster Risk Reduction and Management Offices (CDRRMOs). It was designed and built as an academic project, with the Biñan City CDRRMO as the model case, so the same approach could be reused by other Philippine LGUs.

authors
Juan Raphael A. Dilag · Miguel Joseph M. Medina · Gian Ludvig L. Reyes
adviser
Leonnel D. De Mesa
institution
Mapúa Malayan Colleges Laguna · College of Computer & Information Science
model locale
Biñan City CDRRMO
architecture
4 layers · 3 apps and an admin portal on a shared Supabase backend
Discussion of the features

The system is designed to update how an LGU disaster office handles incident reports and emergency dispatch, replacing phone-hotline reporting, paper logbooks, and radio dispatch with a real-time system that works across web and mobile. Phone-based reporting often gives incomplete details, wrong locations, and slow response. The command center has no single view, and field responders have no digital navigation or clear way to report back. Each app below solves one of these problems. They all share one Supabase backend, built in four layers (presentation, application, business, and data), with PostGIS handling the map and routing data.

Citizen Mobile Application React Native · Expo

The public app for sending structured, geotagged reports with photos and video. Before a citizen can report, the app requires a few steps: email and phone verification, then government-ID verification (OCR reads the name, address, and date of birth) to cut down on fake reports, admin approval, and TOTP MFA at login. Reports are split into Emergency (dispatched right away) and Non-Emergency or community issues (sent to city departments). Each report picks up the phone's GPS location and any photos or video, and the citizen can track the assigned responder and confirm when the issue is resolved. A directory of local hotlines gives a quick-call option.

CDRRMO Admin Web Portal Next.js · Mapbox

The command-center dashboard. New reports appear on a Mapbox map in real time through Supabase WebSocket listeners, split into emergency and non-emergency queues and sorted by type (Fire, Medical, Traffic, Police, Weather), each with its own urgency animation. Operators check reports, assign them to specific field units (which links the report to a responder), and watch analytics on how often incidents happen, where, and how fast they are handled. They can also push public advisories to citizens' phones and create responder accounts outside the public sign-up.

Responder Mobile Application React Native · Expo

The app for responders in the field. A real-time feed delivers assignments with the full context: media, category, and citizen details. Built-in maps give turn-by-turn directions to the exact coordinates. A one-tap status update (En Route, On Scene, Resolved) updates both the admin dashboard and the citizen right away. While en route, the app streams live GPS back to the command center.

Security & data privacy

Built to follow the Philippine Data Privacy Act of 2012 (RA 10173). It uses AES-256 to encrypt personal data at rest and SSL/TLS in transit. Access is controlled by role through Supabase Row-Level Security, which separates the citizen, pending_citizen, responder, and operator accounts. Operators and responders must use MFA. Input validation and rate limiting help block SQL injection and cross-site scripting.

Methodology & evaluation

Built with Agile Scrum in one-week sprints, tracked in GitHub Projects. Work was done on feature branches and merged through pull requests with peer review. Testing ran throughout each sprint and covered unit and integration tests, end-to-end runs from citizen to responder, cross-platform and map testing, load and stress tests, and security scans. This was followed by usability testing with 20 participants using the System Usability Scale, and User Acceptance Testing with 65 participants working through simulated real scenarios.

Screenshots of the GUI
Citizen app Reporting & verification
Citizen app welcome screen with sign-in and create account
Onboarding. The welcome screen. Sign-up is checked by Turnstile, and login uses MFA.
Government ID verification steps
ID verification. The Didit check: ID capture, a selfie liveness test, then review.
Citizen incident report form
Report. The geotagged report form with media.
Report status progression with live map link
Tracking. The report moving from Pending to Dispatch, with a link to the live map of the responder.
Admin portal Command center
Real-time incident map
Triage map. The live Mapbox view of incoming reports.
Portal dashboard with the incident queue
Dashboard. The incident queue, where each report is checked and a unit assigned through Manage.
Analytics dashboard
Analytics. Frequency, location, and response times.
Responder app Field response
Dispatch feed
Feed. Real-time incoming assignments.
Incident details
Details. Full context: media, category, and location.
Turn-by-turn navigation
Navigation. Turn-by-turn routing to the incident.
Assignment marked On Scene with a Resolve button
Status. One-tap En Route, On Scene, or Resolved.
Landing Public site
Public landing page
Landing. The public information site for the system.
Software used
Backend / data
SupabasePostgreSQLPostGISSupabase AuthRow-Level SecurityEdge FunctionsRealtime (WebSockets)Storage buckets
Admin web
Next.js (App Router)ReactTypeScriptTailwind CSSMapbox GL JSLucideSonner
Mobile apps
React NativeExpoExpo RouterNativeWindReact Navigationreact-native-mapsexpo-locationexpo-notifications
Identity / security
Didit ID verification (OCR)Cloudflare TurnstileTOTP MFAAES-256SSL/TLS
Process / tooling
GitGitHub ProjectsAgile ScrumJest
Hardware used

The system is software that runs on standard devices and cloud servers. The hardware below is what it relies on and was tested on, not anything custom-built.

Android smartphones (citizen & responder apps)iOS devices (cross-platform target)Device GPS / location sensorDevice camera (media & ID capture)Development workstationsCloud servers (Supabase-managed PostgreSQL)

Seminars & Workshops

Nine technical seminars and workshops I attended for IT180L across my final year, ordered by how close they sit to the work I actually care about. Each entry is a short summary of what it covered and the takeaway I drew from it.

IoT & hardware

IoT in Action · From Concept to Connection

AWS Cloud Club PUP · John Paul C.· Jan 27, 2026· Competitive workshop· Champion

A hands-on IoT competition run as a timed race. Teams moved through rotational stations to assemble microcontrollers, wire up sensors, and connect the devices to AWS, taking a bare concept through to a live, working build. Short talks set up the state of IoT and how AWS handles the cloud side of connected devices. My team won it.

Takeaway. The race rewarded getting the hardware, the firmware, and the cloud link working together against a clock, not any one piece on its own. It lined up with the IoT builds I have already done, and it was a good reminder that a connected system only counts once every layer talks to the next.

AI & agents

Global AI Manila AgentCamp 2026

Global AI Manila · Ziggy Zulueta· Feb 20, 2026· Hands-on workshop

A hands-on workshop on designing, building, and deploying intelligent agents with the Microsoft Agent Framework, using GitHub Workspaces and Azure to provision the environments. I built and deployed a working agent, one that orders pizza through an MCP server, ahead of the room, working through dependency and path errors in the provided scripts as I went.

Takeaway. The real skill on show was not the framework but reading error logs and fixing configs under time pressure. Debugging a broken setup quickly matters more than knowing the theory cold.

Trust & security

Leading Digital Transformation

JC Principe · CITO / CISO / DPO· Jun 3, 2026· Industry lecture

A C-level view of putting cloud, big data, AI, and IoT to work inside real business processes, with examples across banking, healthcare, retail, and agriculture, and a frank look at legacy systems and data privacy. The parts on protecting sensitive personal data in banking and healthcare landed as a genuine wake-up call.

Takeaway. Technology does not change things on its own; people using it do. The job is aligning a technical solution with the actual community or business problem, which is exactly what my Biñan City capstone is trying to do.

Agile & delivery

116th Agile Philippines Meetup

Agile Philippines · Brillantes & Escañan· Feb 20, 2026· Community meetup

The 116th run of the long-running Agile Philippines meetup, held at GCash's BGC office. A community night for Agile practitioners, from Scrum Masters and developers to project managers and students, to swap notes on how teams actually run software delivery day to day rather than how the framework says they should.

Takeaway. Hearing working Scrum Masters and project managers talk through where Agile bends under real deadlines was more useful than any by-the-book version of it. It maps straight onto how I work as a business analyst between users and engineers, and onto how my capstone team ran its sprints.

QA & testing

Quality at the Speed of Innovation

Tricentis / AIDT · Elbert Guintivano· Mar 13, 2026· Lecture

A session on continuous testing and how AI-augmented platforms automate end-to-end testing to manage risk and speed up enterprise releases. It made the case that shipping code fast is worthless if the code is broken or insecure.

Takeaway. I came away wary of fully closed-loop automation, where one AI writes the code and another tests it. Human verification is still the anchor of real quality assurance.

Data & visualization

Power BI Fundamentals

Florante Sangrenes · PUP· Hands-on data lab

A hands-on lab on business intelligence: importing and cleaning messy data with Power Query, building relational star-schema models, writing basic DAX, and assembling interactive dashboards that tell a data story. When the desktop app would not run on my Linux laptop, I switched to the web version and kept up.

Takeaway. Generating incident data is pointless unless someone can see it. The lab gave me concrete ideas for the capstone, like heat maps and response-time tracking that local officials can read at a glance.

AI & cloud

Head in the Clouds · How AI Transforms Cloud Computing

Mapúa MCL CCIS Student Council · Bryl Kezter Lim· Jul 4, 2026· Seminar & Q&A

A seminar built on the premise that every AI breakthrough rests on a cloud foundation, working through how AI is reshaping cloud technologies, how those technologies power modern applications, and where the openings are for the next wave of tech professionals. The speaker's own track record, from shipping consumer apps to running a large developer community, kept it grounded in practice.

Takeaway. AI is a powerful tool when it is used well: not leaned on to replace what you can already do, but used to amplify it. Over-reliance is the failure mode; amplification is the point.

Infrastructure & connectivity

Philippine Telecommunication Summit 2026

DICT· Feb 5, 2026· Panels & industry Q&A

A summit on the future of Philippine connectivity: 5G expansion, fiber deployment, digital infrastructure, and legislation like the Konektadong Pinoy Act and the National Digital Connectivity Plan. The throughline for me was that even good code depends on physical network infrastructure actually reaching the user.

Takeaway. It exposed a real weakness in my capstone's assumption of stable 5G or WiFi. It pushed me to design for offline fallbacks, like standard phone routing, in areas with poor connectivity.

Trust & security

Proof of Effort · ERC-20 & On-Chain AI Agents

Danielle Meer· Mar 14, 2026· Lecture & gamified lab

An introduction to Web3, blockchain architecture, and decentralized finance, with a gamified platform where we interacted with smart contracts, pulled testnet tokens from a faucet, and saw how ERC-20 tokens work. It set a decentralized, immutable-ledger model of trust against the centralized relational databases I am used to.

Takeaway. A humbling reminder of how wide this field is and how much continuous learning it takes. A tamper-proof public ledger is a genuinely interesting design option for securing public-sector data.