Favio Brañez

Open to internships and freelance

Systems thathold the line.

I'm Favio Brañez, a Systems Engineering student at UNAC. I design databases, write Python and I'm heading toward full-stack, with my sights set on cybersecurity.

projects 4 rows · tap one to see how it works

  1. 01Cyber-ReinosoPoint of sale and sessions for internet cafés.Python · SQL ServerWeb demo
  2. 02SIGTACTriage and beds for hospital emergencies.Python · MySQLIn development
  3. 03Login SystemSign-up and sessions with CSRF, hashes and single-use tokens.PHP · MySQLOpen source
  4. 04CV GeneratorCV editor with live preview, scoring and an ATS-friendly PDF.JavaScript · node:testPublished

The customer first, then the code

Before programming I spent four years working in a warehouse store: customers, inventory and sales on the computer. That's where I learned that a good system saves a real person hours.

I started Systems Engineering at UNAC in 2025 and what hooked me most was databases: every piece of data in its place, with rules keeping it tidy. Now I'm adding the web to build end to end, as a full-stack developer.

A system that stores real people's data has to know how to say no. That's why I'm studying cybersecurity and already applying it: in Cyber-Reinoso nobody changes a balance without going through the rules, and SIGTAC won't classify a patient with incomplete data.

UNAC · 4th termUniversity
Lima, PeruCity
B1 · TOEFL ITPEnglish

My stack, in the same order

Store

  • SQL Server
  • T-SQL
  • MySQL
  • PostgreSQL
  • SQLite
  • Relational modeling
  • Normalization

My favorite part: designing tables that don't contradict each other.

Decide

  • Python
  • OOP
  • DAO pattern
  • Strategy pattern
  • Java
  • C++
  • PHP

Python every day, PHP in my web systems, Java and C++ at university.

Show

  • JavaScript
  • React
  • Tailwind
  • Bootstrap
  • HTML
  • CSS
  • Tkinter

Sites published in plain JavaScript and in React, plus the desktop screens of my systems.

Learning

  • Node.js
  • Cybersecurity

Tying it all together on the web, securely.

Tools

  • Git
  • GitHub
  • Docker
  • Linux
  • Ubuntu Server
  • Windows
  • Vercel

Linux is my everyday system.

Projects

Cyber-Reinoso

Point of sale, inventory and sessions for internet cafés.

In development · desktop, with a React web demo

The decision: the gamer's balance is private. It can be read from outside, but no screen can change it directly: only the class can, with its rules.

  • Python
  • SQL Server
  • T-SQL
  • Tkinter
  • OOP
self.__saldo_billetera = float(saldo_billetera)

@property
def saldo_billetera(self):
    return self.__saldo_billetera

>>>

Access deniedAttributeError: property 'saldo_billetera' of 'Usuario' object has no setter
modelos.py · Cyber-Reinoso · only the class can move the balance

Charging a session

flamed4rk, Gold rank, plays 90 minutes on an eSports PC. The rate comes from the database, Python applies their discount and the cashier deducts the balance.

Store

SQL Server

dbo.CategoriasEstacion

categoriatarifa_hora
Regular2.00
eSports3.00
Streaming VIP5.00

dbo.RangosCuenta

rangodescuento
Silver0.05
Gold0.10

Rates and discounts live in tables: changing a price doesn't touch the code.

Decide

Python
# polimorfismo: cada tipo de PC cobra a su tarifa
costo_base = self.estacion.calcular_tarifa(
    minutos_consumidos)

descuento = costo_base * self.usuario.porcentaje_descuento
monto_a_cobrar = costo_base - descuento
if monto_a_cobrar > self.usuario.saldo_billetera:
    self.monto_cobrado = self.usuario.descontar_saldo_hasta_cero(...)
else:
    self.usuario.descontar_saldo(monto_a_cobrar)

If the balance falls short, it charges down to zero instead of going negative.

Show

Cashier
F
flamed4rkPC-005 · eSports
Time90 min
RateS/ 4.50
Gold discount− S/ 0.45
ChargedS/ 4.05
Remaining balanceS/ 35.95

The PC becomes available again for the next customer.

Example computed with the repository's seed data and the finalizar_sesion method.

SIGTAC

Triage and bed assignment for hospital emergencies.

In development · desktop

The decision: if a vital sign is missing, the system refuses to classify the patient. A value that wasn't measured is never assumed to be normal.

  • Python
  • MySQL
  • PostgreSQL
  • SQLite
  • Strategy pattern
  • DAO pattern
def _exigir_signos(signos_vitales, *claves):
    faltantes = [c for c in claves
                 if signos_vitales.get(c) is None]
    if faltantes:
        raise SignosVitalesIncompletosError(...)

>>>

Classification blockedSignosVitalesIncompletosError: No se puede clasificar: faltan los signos vitales sato2.
estrategias.py · SIGTAC · an unmeasured value is never assumed normal

Classifying a patient

A patient arrives with chest pain. SIGTAC requires their vital signs, applies the Manchester rule and proposes a triage level with its justification.

Measure

Vital signs

signos_vitales · dict

clavevalor
sato288
pa_sis110
fc104

sintomas

sintomapeso_clinico
Chest pain8.5

Each symptom carries a clinical weight; any missing sign blocks the classification.

Decide

Python · Strategy
peso_total = sum(s.peso_clinico for s in sintomas)
self._exigir_signos(signos_vitales, 'sato2', 'pa_sis')

if peso_total >= 10 or sato2 < 90 or pa_sis < 80:
    return 1  # Nivel I (Rojo)elif peso_total >= 7 or pa_sis > 180:
    return 2  # Nivel II (Naranja)
elif peso_total >= 4:
    return 3  # Nivel III (Amarillo)

The symptom alone would give Level II; the low saturation raises it to Level I. With the MINSA rule, a different strategy, the same patient is evaluated differently.

Show

Interface
P
Test patientEmergency · Triage
Level I · RedManchester
SatO288 %
Clinical weight8.5

Suggested classification following the Emergency Triage guidelines: Manchester Triage System.

The screen shows the level and the standard it was based on.

Fictional patient. Real logic from the ReglaManchester and EstrategiaTriaje classes.

Login System

Sign-up and login with email verification and password recovery.

Open source · PHP web app

The decision: verification and recovery links are never stored in plain text. The database only holds their SHA-256 hash; they expire and work only once.

  • PHP
  • MySQL
  • PostgreSQL
  • SQLite
  • PDO
  • CSRF
  • password_hash
function verify_csrf(): bool
{
    $sent = $_POST['csrf_token'] ?? '';
    return is_string($sent)
        && hash_equals(csrf_token(), $sent);
}

$

Request rejectedLa sesión del formulario expiró. Intenta nuevamente.
functions.php · login-system · a form without its token doesn't get in

Logging in

A user signs in with their password. The database never had it in plain text: PHP compares it against the hash, checks that the email is confirmed and issues a fresh session.

Guardar

MySQL

users · schema.sql

usernamepassword_hash
demo$2y$10$Qx7…
ana_r$2y$10$Lm2…

user_tokens

typetoken_hash
password_reset9f2c41…

Passwords with password_hash and tokens as SHA-256: if the database leaks, the keys don't.

Decide

PHP
if (!$user || !password_verify($password,
        $user['password_hash'])) {
    $error = 'Usuario o contraseña incorrectos.';
} elseif ($user['email_verified_at'] === null) {
    $error = 'Debes confirmar tu correo…';
} else {
    // Nuevo ID de sesión para evitar fijación de sesión
    session_regenerate_id(true);    $_SESSION['user_id'] = (int) $user['id'];
}

The same message whether the user or the password fails: it doesn't tell an attacker which one was right.

Show

Interface
D
demoUser dashboard
Logged in✓
EmailConfirmed
Session IDNew
Password in databaseHash only

Only now does the dashboard appear; before that, every page demands it with require_login().

Example user and hashes. Real code from login.php, functions.php and schema.sql in login-system.

CV Generator

Résumé editor with live preview, 4 templates and a PDF that ATS filters can read.

Published · web

The decision: validation, scoring and saving live in DOM-free modules. That way they're tested with 36 node:test tests, with nothing to install.

  • JavaScript
  • ES modules
  • node:test
  • Accessibility
CV editor on the left and a preview with the Modern template on the right
cv-generator-beryl-two.vercel.app

Scoring a CV

As you type, the CV goes through a list of criteria. Each one adds points or leaves a concrete tip, and the screen shows the score and what's missing.

Write

JS object
{
  personal: { fullName: "Valeria Q.",
              email: "…@example.com" },
  summary: "Developer…", // 219 chars  experience: [ /* 2 entries */ ],
  education: [ /* 1 entry */ ],
  skills: [ /* 8 skills */ ]
}

The form and the CV share a single object, saved in localStorage.

Decide

score.js
{
  points: 15,
  test: (cv) => {
    const length = cv.summary.trim().length;
    return length >= 150 && length <= 600;
  },  tip: 'Escribe un resumen de 150 a 600…',
},

for (const criterion of CRITERIA) {
  if (criterion.test(cv)) score += criterion.points;
  else tips.push(criterion.tip);
}

Each criterion is a pure function: it's tested on its own, without opening a browser.

Show

Interface
CV
Valeria QuispeModern template
95 · ExcellentPDF ready

Tip: Quantify your achievements with numbers (e.g. "cut load time by 40%").

Only the 3 most important pending tips are shown.

Sample CV. Real criteria and messages from score.js in cv-generator.

Design and frontend

Home page of Nevado, a trekking operator

Nevado

Trekking operator in the Andes: a route explorer with SVG elevation profiles and a quote calculator.

React · Vite · TailwindFictional business · portfolio project

Home page of Madera Viva, a luthier workshop

Madera Viva

Luthier workshop and guitar school in Barranco: an interactive guitar anatomy and full-scale technical drawings.

HTML · CSS · JS, no frameworksFictional business · portfolio project

Also: the academic database of a language institute, in SQL Server.

A good system goes unnoticed.

It simply works. That's why I first understand the problem and only then choose the technology.

What's next

  1. Solving my first CTFthis year
  2. My first contribution to an open-source projectthis year
  3. Writing about how I secured Login Systemdown the road
  4. English C12027

You bring the problem.
I build the system.