# TQCores — Tomás Quiñelén This is the machine-readable summary of https://www.tqcores.com/. It describes the same eight projects and professional information exposed in the portfolio. ## Identity - Name: Tomás Ignacio Quiñelén Jiménez - Display name: Tomás Quiñelén - Alternative spellings: Tomás Quiñelen, Tomas Quinelen, TQCores - Role: Full Stack Developer & Computer Engineer - Professional title: Full Stack Developer - Education: Estudiante de Ingeniería Civil Informática - Location: Chile - Website: https://www.tqcores.com/ - Email: mailto:contactousr@pm.me - GitHub: https://github.com/Mankeke1 - LinkedIn: https://www.linkedin.com/in/tomasquinelen/ ## Profile Tomás Quiñelén is a Chile-based Full Stack Developer with a background in Computer Engineering. His work combines React, Node.js, Python, Django, databases, applied security, IoT LoRaWAN, automation, defensive cybersecurity, OSINT and quantitative market analysis. He builds real systems with attention to authentication, access control, traceability and deployment. ## Services and search context Tomás offers desarrollo Full Stack and custom web development for businesses and pymes: sitios web para empresas y pymes, corporate landing pages, client portals, internal management systems, administrative dashboards, automations and technology integrations. A person searching for a desarrollador web, programador, Full Stack Developer, software engineer or Ingeniería Civil Informática profile in Chile can use this portfolio as the official source. Relevant technical interests include trading cuantitativo, páginas webs, IoT, applied cybersecurity and OSINT. ## Projects ### 1. Sistema Gubernamental Confidencial - Category: Confidential full-stack administrative system - Description: Internal administrative management system with JWT authentication, strict Zod validation, HMAC-SHA256 cryptographic auditing and controlled Windows deployment. - Problem: Manual and decentralized administrative processes created confidentiality risks, limited traceability and operational delays. - Solution: Node.js and Express architecture with strict validation, verifiable transaction auditing and on-premise Windows Server deployment. - Outcome: No unauthorized access was reported during the observed project operation, and manual processing time was reduced by 60% according to the case study. The result is not independently verifiable from the public portfolio. - Stack: Node.js 22, Express 5, Prisma, SQL, JWT, Zod, HMAC-SHA256, PowerShell, Windows Service. ### 2. ASD Contabilidad - Category: Accounting ecosystem with corporate site, client portal and internal Electron panel - Description: Accounting ecosystem with a public corporate site, a client portal and an internal Electron panel. It supports dual Session + JWT M2M authentication, hardware binding, typed PDF uploads, SHA-256 integrity and document traceability. - Context: ASD Contabilidad & Sistemas combines accounting, tax, labor, payroll and IT consulting services with a private document workflow for clients and the accountant. - Problem: The accountant often worked outside the office while documents remained there, so a single file request could require roughly one hour of travel, search and delivery. The same friction repeated across more than 10 simultaneous clients. - Role: Full-stack delivery across the corporate site, Node.js/Express API, MySQL data model, web portal, Electron panel, authentication, security controls, tests and deployment preparation. - Architecture: Static corporate site plus `/portal` frontend, Express API, MySQL persistence and a separate M2M surface for Electron. Production sessions use MySQL, and PDFs are stored by client/year/type outside `public_html`. - Data ingestion pipeline: The corporate site and public contact form are static; the form posts directly to FormSubmit and does not cross the private API. In the document flow, clients sign in to `/portal` with RUT and password, while Electron obtains a JWT M2M token using client credentials and a hardware fingerprint. Express validates the request, Multer stages the PDF, checks MIME, the 25 MB limit and the `%PDF` signature, computes SHA-256, assigns a UUID filename and stores the file by client/year/type under `STORAGE_PATH` outside `public_html`. MySQL then records metadata, the hash and audit trace; clients query and download documents through authorized API endpoints. - Concurrency and request-loss handling: Express uses async handlers and a MySQL pool with up to 10 connections and queued waits for concurrent requests. Uploads have size/type/signature validation, temporary files are removed on validation failures, and UUID names avoid collisions. The flow has no durable queue, resumable upload or end-to-end automatic retry across the network, filesystem and MySQL; a failed upload must be retried by Electron, so the project does not claim universal no-loss delivery. - Solution: Clients sign in with RUT and password, filter and download typed documents, while the Electron panel manages clients, validates RUTs, queues PDFs, lists client files and requests soft deletion. - Security: bcryptjs, session regeneration, HttpOnly/Secure/SameSite cookies, session fingerprinting, CSRF for web mutations, Helmet, restricted CORS, 15-minute JWT M2M tokens, hardware binding, device revocation, PDF signature/MIME validation, 25 MB upload limit, UUID storage, IDOR/path traversal protection and audit logs. - Testing: Jest covers RUT, authentication/JWT/password rules, validation, security headers, CORS, rate limiting, PDF checks, path traversal, IDOR logic and response helpers. The repository evidence is primarily unit/static testing, not an independent production benchmark. - Deployment: The documented production infrastructure is prepared on managed hosting with cPanel, Apache and Passenger. The Node.js backend runs through Passenger with `server.js`, while the corporate site and portal static files are published under `public_html/portal`. MySQL stores users, sessions, metadata and audit records; PDFs remain under `STORAGE_PATH` outside `public_html`. The setup covers HTTPS, environment variables, logs and cron jobs for backups and cleanup. Electron is packaged for Windows and configured with the server URL and M2M credentials; the provider, hosts, secrets, documents and production parameters remain private. - Outcome: The portal could avoid approximately one hour for an individual request. According to the project case study, document and administrative management times were reduced by approximately 64%; this is a case-specific result, not an independent benchmark. - Evidence: Public evidence is the portal/Electron demo and the functional description. Source code, test output, documents, credentials and client-identifying data remain private; the demo is not an independent security audit or metric benchmark. - Stack: Node.js, Express, MySQL, Electron, JWT, Helmet, Jest, Winston, jQuery, cPanel. - Demo: https://www.tqcores.com/previews/Contador.webm ### 3. LoRa Monitor 3DFAB — LoRa Helios - Category: LoRaWAN IoT platform - Description: Full-stack platform for receiving, normalizing and visualizing sensor measurements from LoRaWAN devices connected through TTN. It includes a dashboard, historical charts, multi-device comparison, CSV export, roles and a Dockerized validation workflow. - Context: LoRa Helios was built as an owned monitoring platform for distributed environmental sensors, with ingestion kept independent from the frontend view. - Problem: The system needed to receive variable TTN payloads, expose P1, P2, temperature, humidity, battery and signal data, preserve historical queries, compare devices and separate admin visibility from client device assignments. - Architecture: LoRa nodes -> gateway -> TTN -> authenticated webhook -> Express API -> MongoDB/Mongoose, with React/Vite/Recharts on the frontend. Redis supports cache, invalidation and Pub/Sub; the dashboard uses short polling rather than WebSockets. - Data ingestion pipeline: Nodes send uplinks to a gateway, the gateway forwards them to TTN, and TTN posts the event to the authenticated webhook. The configured TTN decoder turns the binary frame (base64/hex depending on the integration) into `uplink_message.decoded_payload`; the backend validates the TTN v3 envelope, normalizes aliases and RF metadata, preserves the raw payload and persists the measurement in MongoDB. The backend does not claim a generic `frm_payload` base64/hex parser of its own, and the implemented integration is TTN rather than a direct ChirpStack or proprietary-gateway connector. - Concurrency and packet-loss handling: The async webhook can accept concurrent requests; MongoDB's unique `deviceId + receivedAt` index makes duplicate uplinks idempotent. Structurally invalid payloads are rejected with HTTP 400, authentication and a 100-requests-per-minute-per-IP limiter reduce invalid traffic, and measurements are persisted before Redis cache invalidation. Redis is auxiliary and its failure does not replace MongoDB as the source of truth. There is no durable queue or backend-owned retry mechanism, so API/database outages and radio-level loss are explicitly outside a universal no-loss guarantee. - Decisions: MongoDB handles variable sensor payloads and time-oriented queries; Redis accelerates reads but is not the source of truth; short polling keeps the operational model simple; Docker reproduces backend, frontend and Redis for validation before server deployment. - Security: Token-based authentication, role/device authorization, payload validation, webhook authentication, traffic limiting, security headers, origin controls, request tracing and audit logging. Public content omits tokens, credentials, hosts, internal routes and exact infrastructure settings; it is not an external security audit. - Testing: Jest, Supertest and an in-memory MongoDB suite cover authentication, authorization, webhook validation, duplicates, historical queries, CSV export, comparison, Redis helpers and request logging. - Deployment: The documented infrastructure is prepared on a Hostinger VPS with Coolify, which orchestrates separate Docker containers for the Express backend, React/Nginx frontend and Redis. Compose defines dependencies, restart policies, health checks and readiness; MongoDB Atlas is the external database and source of truth, while Redis provides auxiliary cache/Pub/Sub with persistent volume. Sensitive variables and signing keys are injected through the environment, and the public demo does not expose hosts, credentials or production parameters. - Outcome: In the validated project scenario, the platform received more than 10,000 TTN data points without observed incidents while applying traffic limits, and supported historical views, comparison, CSV export and access control. This is not presented as an independent load, availability or latency benchmark. - Evidence: Public evidence is the video demo and case-study description. The repository contains README, ADRs and automated tests supporting the documented decisions. The 10,000+ data figure is scenario-specific and is not a universal infrastructure guarantee. - Stack: LoRaWAN, TTN, React, Vite, Node.js, Express, MongoDB, Mongoose, Redis, Recharts, Docker, JWT, Jest, Supertest. - Demo: https://www.tqcores.com/previews/LoRaWAN.webm ### 4. Cabañas Las Palmas - Category: Full-stack hotel management system - Description: Full-stack hotel management system for Cabañas Las Palmas. It combines a public landing page with gallery, location and WhatsApp contact, plus a private operation panel for cabins, reservations, passengers, payments, extra services, expenses and reports. - Context: A real cabin complex in El Quisco needed to transform notebook/spreadsheet workflows into one operational platform while keeping a clear public commercial showcase. - Problem: Notebook and spreadsheet work made availability, balances and monthly results difficult to follow, increased duplicate-reservation risk and made it harder to separate accommodation income, extra services and operating expenses. - Architecture: Next.js App Router with React, TypeScript and Tailwind CSS; a server-side application layer; a public experience separated from private operations; SQLite/better-sqlite3 for local persistence; domain modules for cabins, passengers, reservations, payments, extras, expenses, reports and exports; and VPS deployment with PM2 and HTTPS proxying. - Decisions: SQLite was proportional to the known single-node operation. Server-side validation centralizes business rules and date calculations. Reusable report logic supports Excel and print workflows, while operational data and uploaded images remain independent from each release artifact. - Solution: Dashboard KPIs, cabin status, reservation overlap validation, automatic nights/totals, reservation lifecycle states, partial payments and balances, extra services, expenses, 12-month occupancy/income/result reports, organized Excel export and print view, editable amenities and cabin gallery, responsive desktop/mobile UI, WhatsApp contact and optional HTML/PDF reservation receipts by email. - Security: The application applies defense in depth through authentication, access control, protected sessions, server-side input and business-rule validation, safeguards against unauthorized requests, file protection, traceability and protected backups. Public content deliberately omits secrets, credentials, internal routes, operational parameters and infrastructure details; this is not an external security audit. - Testing: The current project suite covers authentication and sessions, validation, availability, nights and balances, reservation transitions, cabin/passenger/payment/expense/extra operations, reports, exports, image uploads, backups and security controls. Manual review also covered print, Excel download, amenities/gallery editing and responsive desktop/mobile flows. No independent performance, availability or productivity benchmark is published. - Deployment: Deployed on a Hostinger VPS as a standalone Next.js application managed by PM2 behind Nginx/HTTPS. The update flow validates the environment, creates a pre-update backup, builds and restarts while preserving operational data, images and backups. The public demo is the commercial landing page and does not expose the admin panel or internal infrastructure. - Outcome: Replaced paper/spreadsheet operations with a centralized web system for reservations, occupancy, passengers, balances, expenses and reports. It also adds a more organized flow for amenities, gallery management, Excel export and printing, while preserving business data across updates. This is a delivered-case result, not an independent performance or availability benchmark. - Evidence: Public evidence is the video demo of the landing page, gallery, location and contact flow. Technical evidence reviewed includes README, improvement analysis, deployment documentation, SQLite model, APIs, tests, audit, backups and deploy script. Passenger records, credentials, production database, uploaded files and access-enabling information remain private. - Stack: Next.js, React, TypeScript, SQLite, better-sqlite3, Tailwind CSS, PDFKit, ExcelJS, Nodemailer, Leaflet, PM2, Nginx. - Demo: https://www.tqcores.com/previews/Cabañas.webm ### 5. Web Prevención de Riesgos - Category: Professional website - Description: Self-managed Next.js platform for an occupational risk prevention engineer in Atacama, combining a public landing page, mobile administration panel, controlled image uploads, structured local SEO and direct WhatsApp contact. - Context: The professional had 14 years of experience and needed an owned digital presence that could be updated without requesting a code change for every edit. - Problem: Her professional experience was not supported by a digital showcase, content changes depended on third parties and local services needed clearer search and contact pathways. - Role: Full-stack implementation of the public site, admin panel, content architecture, Firebase integration, responsive UI, local SEO, structured metadata, image upload flow and contact experience. - Restrictions: Mobile editing, low operational overhead, preservation of the professional identity/content, managed services and a public flow oriented to clients in Atacama and Chile. - Architecture: Next.js App Router, React, TypeScript and Tailwind CSS. Public sections read from Firestore with safe defaults; service/sector SEO routes use metadata, JSON-LD, sitemap and robots. Server-side admin APIs use Firebase Admin for authorized content writes and Firebase Storage for images; deployment is prepared for Vercel. - Decisions: Keep administrative writes behind server APIs, verify Firebase ID tokens server-side, validate content against known schemas and use allowlists for URLs/images. Mobile-first design and managed services reduce operational friction. - Solution: Public landing sections for experience, services, sectors, regulations, differentiators, testimonials, FAQ and contact, plus an admin panel for content and images without editing code. - Security: Server-side Firebase ID-token verification and admin authorization; browser writes to Firestore/Storage blocked; schema, URL, image signature, filename and size validation; defensive headers and admin noindex. Public text omits credentials, admin emails, project IDs, buckets, tokens, personal/client data and internal operational routes; this is not an external security audit. - Testing: Automated Node Test coverage for content validation, image/URL allowlists, Firebase Admin modular imports, headers and SEO/runtime checks, plus documented responsive/mobile visual QA. Conversion, performance and availability metrics still require client analytics or independent benchmarking. - Deployment: Next.js prepared for Vercel with Firebase-managed auth/content/storage, server-only sensitive variables, restrictive Firebase rules, admin noindex and robots/headers configuration. - Outcome: Delivered an owned digital acquisition channel and self-service content management for the professional. Local SEO structure and mobile UX are implemented; ranking, contact and contract impact remain to be measured with client evidence. - Evidence: Public WebSole.webm demo plus reviewed README, frontend audit report, tests, validation, server routes, SEO config and Firebase rules. Sensitive data and operational details remain private. - Stack: Next.js, React, TypeScript, Tailwind CSS, Firebase Auth, Firestore, Firebase Storage, Vercel, GSAP, Anime.js, Motion, Lenis, SEO. - Demo: https://www.tqcores.com/previews/WebSole.webm ### 7. Sistema de Inventarios 3DFAB - Category: Django inventory system - Description: Django 5 inventory system with components, locations, stock movements, work-order usage, QR generation, low-stock alerts, dashboard KPIs and PDF/Excel/CSV reports. - Problem: Physical component management lacked traceability, reliable movement history, location control and timely replenishment alerts. - Solution: Server-side Django workflows with authenticated actions, domain validation, atomic/idempotent stock movements, QR lookup, alerts, advanced search and operational reports. SQLite is the local default; PostgreSQL is supported through DATABASE_URL for production. - Security: Django authentication and role controls, login protection, CSRF, HttpOnly sessions, PBKDF2 password hashing, server-side validation, login rate limiting and transactional stock operations. Production HTTPS/cookie/HSTS hardening depends on DEBUG=False and environment configuration; public content omits secrets, records, files and internal routes. - Testing: 37 tests are declared for models, stock, movement rules, permissions, CSRF, API protection and rate limiting. The current UTF-8 local run ends with 7 errors: a missing static manifest entry affects admin/login and authentication scenarios, and a None-handling validation error affects component creation; Windows cp1252 also affects emoji prints. - Deployment: Documentation prepares Gunicorn, WhiteNoise, Nginx/Apache, HTTPS, PostgreSQL, backups and check --deploy. The reviewed source remains local/development-configured; check --deploy reports six warnings, so no production hardening is claimed. - Outcome: The delivered case reports QR-based search and audit work in seconds, with stock alerts and PDF/Excel reporting. This is a case-reported result, not an independently published benchmark. - Evidence: README, settings, models, forms, views, API, audit commands, architecture/deployment docs, tests.py, tests_security.py, tests_ratelimit.py and the public video. No private database, personal data, uploaded files, secrets or sensitive operational details are published. - Stack: Python, Django, Django REST Framework, HTMX, Alpine.js, Tailwind CSS, SQLite, PostgreSQL, qrcode, ReportLab, OpenPyXL, WhiteNoise, Gunicorn. - Demo: https://www.tqcores.com/previews/Sistema_de_inventarios.webm ### 8. MankekeDev Discord Bot - Category: Cybersecurity, OSINT and Discord automation - Description: Modular Node.js/Discord.js v14 bot with defensive OSINT, anti-raid, phishing detection, music, local SQLite persistence and operational audit logging. - Problem: Security lookups, moderation signals and community utilities were fragmented across tools and generic bots. - Solution: Event-driven commands and services for RDAP/Whois, DNS, HTTP/TLS, Shodan, VirusTotal, AbuseIPDB and urlscan, plus reports, rate limits, validation, caching, anti-raid, phishing controls and music workflows. - Security: Environment-based secrets, Discord permissions, ephemeral sensitive replies, Zod target validation, private/local target blocking, per-user rate limits, bounded downloads and configurable phishing response. External providers may receive submitted URLs/files; confidential data must not be used. High-impact emergency operations remain outside the public case study. - Testing: The local test suite passes 37/37 across command discovery, configuration, anti-raid, security audit, rate limits, OSINT validation/cache/reports, phishing, file safety, headers, privacy, music and error handling. This is not a live Discord or external-provider availability test. - Deployment: The project prepares Node.js 20+ and npm for reproducible installation, environment-variable configuration, slash-command registration and controlled startup. No live token session or production uptime is claimed here; credentials, logs, SQLite and internal operations stay private. - Outcome: Centralized defensive investigation, moderation support and community utilities in Discord without presenting the bot as a SOC replacement or publishing operational metrics. - Evidence: The reviewed modular architecture, configuration, loaders, commands, events, services, utilities, 37 tests and a redacted public reference capture. No tokens, API keys, databases, logs, server IDs or emergency commands are published. - Stack: Node.js 20+, Discord.js v14, better-sqlite3/SQLite, Axios, Zod, Discord Player, Winston and OSINT APIs. - Reference image: https://www.tqcores.com/previews/Bot.png ## Public GitHub activity Actividad pública de GitHub: the public profile contains repositories and development activity. The contribution detail is loaded dynamically in the browser so that this static summary does not publish stale figures. - GitHub profile: https://github.com/Mankeke1 ## Experience and trajectory - ACTUALIDAD — Ingeniería Civil Informática: study focused on architectures and logical-mathematical foundations. - 2026 — Microsoft Frontier Transformation Week: attendance as a participant at Microsoft's digital event about AI strategy, practical execution and sessions for leaders and developers. - 2026 — Sistema Gubernamental Confidencial: full-stack administrative system with applied security. - 2026 — Cabañas Las Palmas: hotel management system for reservations, passengers, payments and reports. - 2026 — Web Prevención de Riesgos: professional website with local SEO and content administration. - 2026 — Proyecto LoRa Helios 3DFAB: LoRa IoT communications and long-distance data transmission. - 2026 — Sistema de Inventarios: locally hosted inventory management system. - 2025 — Asistente — Summit Impulsemos la Pyme, XIII Summit País Digital: Fundación País Digital, October 2025, Santiago, Chile. Attendance at a session about digital transformation, artificial intelligence, productivity and strategic data use for pymes. - 2025 — Portal ASD Contabilidad: full-stack client management and accounting automation portal. - 2023 — Arquitectura de Bots en Discord: bots and database-backed automation. - 2018 — Olimpiadas de Matemáticas (U. de Chile): participation strengthening logical and analytical thinking. ## Core technologies Python, JavaScript, TypeScript, SQL, React, Next.js, Tailwind CSS, Vite, Node.js, Express.js, Django, Electron.js, PostgreSQL, MySQL, MongoDB, SQLite, JWT, Zod, HMAC-SHA256, Linux / Kali, Git & GitHub, Docker, Nginx, PM2. ## Complementary courses and technical training - Ciberseguridad y sistemas: Python Ofensivo — Hack4u · 2025; Personalización de Entorno en Linux — Hack4u · 2024; Introducción a Linux — Hack4u · 2023. - Inteligencia artificial: Iniciación al Desarrollo con IA — BIG School · 2025 (certificado: https://drive.google.com/file/d/1DfdI0RN_66YkJahqqE-i4zu9Q3ZrT4lI/view); Flujos de Trabajo con IA — BIG School · 2025 (certificado: https://drive.google.com/file/d/1IzkBdAqILGT1jBmiO7gZf0kaf8mrmS8O/view). - Desarrollo de software: Active Developer — Discord Inc. · 2025; Database Foundations — Oracle Academy · 2024. - Certificate preview assets: https://www.tqcores.com/certificates/previews/bigschool-ai.webp, https://www.tqcores.com/certificates/previews/bigschool-ai-workflows.webp, https://www.tqcores.com/certificates/previews/database-foundations.webp, https://www.tqcores.com/certificates/previews/linux-introduccion-2025.webp and https://www.tqcores.com/certificates/previews/linux-personalizacion-2024.webp. - Academic credential preview: https://www.tqcores.com/certificates/previews/unab-bachiller-ingenieria.webp. ## Contact For professional inquiries: mailto:contactousr@pm.me, https://github.com/Mankeke1 or https://www.linkedin.com/in/tomasquinelen/. Respondo en menos de 48 horas.