Joshua Talato
Contact

Software that works.Security in mind.

I’m Joshua, a software developer working across web applications, APIs, and databases—with practical familiarity with security fundamentals.

View selected work View CV
Software development & security fundamentalsExplore the dossier

Selected work.

The applications I’ve worked on.
The decisions behind them.

AruCup

Karate tournament management

A karate tournament platform covering athlete registration, competition brackets, official results, and dojo medal reporting.

My contributions

Built registration and bracket workflows, role-based permissions, database policies, audited result corrections, and PDF reports.

  • React
  • TypeScript
  • Supabase
  • PostgreSQL
Login · 1 / 4

What I built

Registration imports and eligibility review, single-elimination brackets with balanced byes and dojo separation, result correction, placements, and PDF medal reports.

Access with boundaries

Application roles and tournament assignments control who can operate each tournament. Bracket Officials are limited to assigned published brackets, while private registration records remain restricted.

Security concepts in practice

Row-level security, least-privilege database function grants, audit history, and security headers including a backend-specific Content Security Policy. Regression coverage addresses database rules and access controls.

Sheilz Web

Coffee shop administration

A coffee shop back-office dashboard for sales, inventory, staff administration, and business reporting.

My contributions

Created the database schema and security policies, implemented staff access and audit logs, and connected dashboards, analytics, and reports.

  • Next.js
  • TypeScript
  • Supabase
  • SQL
Analytics · 1 / 2

Database to dashboard

Established the initial database schema and security policies, then connected dashboards, inventory-turnover analytics, diagnostics, and filtered Excel/PDF reports to database queries.

Accounts & sessions

Implemented sign-in, protected routes, role-aware controls, and administrator-only role changes. Added checks that block customer and inactive accounts from the staff dashboard and remove access after deactivation.

Traceable operations

Built application and database audit logging, before/after record comparisons, actor context, and distinct export events, alongside staff management and historical sales entry.

P.A.C.E.

Alumni career & employability

An alumni career platform combining graduate records, job opportunities, employability insights, and institutional forecasts.

My contributions

Built data models and APIs, integrated existing prediction services, and developed the AI career advisor and faculty forecasting interface.

  • Next.js
  • FastAPI
  • PostgreSQL
  • Python
Landing page · 1 / 3

Data & API integration

Built job-listing and prediction data models, migrations, validated input schemas, and APIs that connect existing employability, salary, job-search-duration, and forecasting services to stored records.

From results to understanding

Developed the Gemini-based alumni career advisor, including conversation context and follow-up states. Built faculty forecasting reports with confidence bands, diagnostics, and selectable forecast periods.

My contribution

My scope covered models, API integration, advisor interactions, reports, and revised regression inputs. The underlying machine-learning and ARIMA algorithms were existing services in the shared project.

Pharmacy Inventory

Product & inventory management

A pharmacy inventory system for managing products, purchase orders, stock records, and operational reports.

My contributions

Implemented product and archive workflows, role permissions, email OTP login and recovery, user administration, and PDF exports.

  • Django REST
  • JavaScript
  • PostgreSQL
  • Gmail API
Dashboard · 1 / 3

Operational workflows

Implemented API-backed product management, archive and restore workflows, order views and filters, live dashboard counts, PDF reports, and the administrator user-management interface.

Authentication & permissions

Built server-side login/logout and current-user APIs, applied Admin, Staff, and Clerk permissions across endpoints, and introduced administrator-only account-management APIs.

Verification & recovery

Added credential verification followed by an emailed OTP before session creation, including expiry and resend handling. Built password recovery with reset OTP verification and reset-session validity checks.

A security-aware
way of thinking.

I’m familiar with the fundamentals of protecting application data and controlling access. My projects have given me practical experience applying these concepts.

Familiarity, backed by implementation.
Authentication & session handling

Understanding who is signing in, and when their access should end.

I’ve worked with credential-based login, email OTP verification, password recovery, and session checks. In Sheilz POS, inactive accounts are blocked and access is removed when an account is deactivated.

See Sheilz POS
Authorization & least privilege

Giving each role the access its responsibilities actually require.

I’m familiar with role-based access and enforcing boundaries beyond the interface. AruCup limits officials to assigned published brackets and restricts their access to private registration records.

See AruCup
Database security & integrity

Keeping permissions and validation close to the data.

My project work includes row-level security, database function grants, validated inputs, and transactional operations. AruCup also uses match-version checks and audit history around result changes.

See AruCup
Audit trails & browser defenses

Making changes traceable and understanding the browser’s security boundaries.

I’ve implemented application and database audit events, before/after records, export logging, and security headers. AruCup includes a backend-specific Content Security Policy and checks against privileged credentials in frontend configuration.

See AruCup

Beyond the code.

Research, context, and careful analysis.

Making complex information clear enough to act on.

I researched US government contract opportunities and developed competitive analyses to support opportunity evaluation and bid strategy.

Remote Research Specialist

90Degrees of Design Inc.

January 2025 — October 2026

The work involved structured pre-screening records, opportunity tracking, agency calendars, and organizing reference documents—alongside clarifying details with contracting personnel.

  • Competitive analysis

    Opportunity evaluation & bid strategy

  • Structured research

    Pre-screening & reference documents

  • Opportunity tracking

    Contract opportunities & agency calendars

A developer who likes the details.

Freelance Software Engineer October 2026 — Present

I enjoy translating operational rules into useful software—from tournament brackets to reporting workflows and database permissions.

My work connects the interface people use with the data and decisions underneath it.

Education

BS Information Technology

Pamantasan ng Lungsod ng Pasig

Expected April 2027GWA 1.32

Recognition

1st Place

Database Programming

14th National IT Skills Olympics

1st Place

Best Presenter

4th Regional Student Research Colloquium · Sheilz POS

Tools I work with

Interfaces

  • TypeScript
  • JavaScript
  • React
  • Next.js
  • HTML
  • CSS

APIs & data

  • Python
  • FastAPI
  • Django REST
  • PostgreSQL
  • Supabase
  • SQL

Development

  • Git
  • GitHub
  • Docker
  • Automated testing
  • Cloudflare Pages

Let’s build
something useful.

Have an opportunity or a question about my work?
I’d be glad to hear from you.

View CV