Adding a Content-Security-Policy to a static Astro site on Cloudflare
How I added a CSP and security headers to this portfolio with a single _headers file, and the third-party hosts it would have silently blocked.
02 / about
About
I'm Sibongakonke Simamane, a full-stack developer in Durban, South Africa. I finished a Diploma in Systems Development (HDIPSD2) at Boston City Campus with a 76% average, a pass with distinction, and I hold CompTIA A+ and Security+.
I work in Java, PHP, JavaScript and TypeScript, with React, Astro, Node.js, Docker and MySQL. At Future ProTechY I build backend services for financial systems and work with AWS day to day: VPCs, EC2 and GitHub Actions pipelines. I am still learning the cloud side, and I say so.
Before writing code I want to understand the business. I have done requirements gathering and analysis on client work, and I delivered the Asante Financial Services loan platform on my own, from the first conversation to the production server.
- basedDurban, South Africa
- statusAvailable for freelance & contract projects
- focusFull-Stack Web, Cloud Infrastructure (Learning) & Cybersecurity
- currentlyJunior Systems Developer at Future ProTechY
- cloudAWS (VPC, EC2, CI/CD) at work, still learning
- educationDiploma HDIPSD2 (76% Distinction)
03 / services
Services & Solutions
Web applications, backends and databases, and help with AWS. Here is what I take on.
01Backend
APIs and database design
REST APIs and normalised MySQL or SQL Server schemas. I have built one for a lender: encrypted customer data, role-based access, audit logs and multi-factor login.
Key Deliverables:
- →REST API design and integration
- →Relational schema design (MySQL, SQL Server)
- →Authentication, authorisation and input validation
- →Business logic and data export workflows
02Web
Web applications and client portals
Customer portals, admin dashboards and business websites, built in React or Astro on a PHP or Node backend. Responsive, quick to load, and designed around what the business needs to do.
Key Deliverables:
- →React and Astro front ends
- →Customer portals and admin interfaces
- →Layouts that work on phone and desktop
- →Performance and SEO basics done properly
03Cloud (learning)
AWS setup: VPCs, EC2 and CI/CD
I work with AWS at Future ProTechY and am still learning it. I can set up a VPC, EC2 instances and a GitHub Actions deployment, and I am clear about where I would want a more experienced engineer to review the result.
Key Deliverables:
- →VPC, subnets and security groups
- →EC2 provisioning and Linux administration
- →GitHub Actions and Docker deployments
- →Working alongside your team or a senior reviewer
04Security and maintenance
Security review and ongoing support
A review of an existing application for common security problems, fixes for production bugs, performance work, and ongoing support if you want someone to call.
Key Deliverables:
- →Review against common vulnerability classes
- →Bug fixes and performance work on existing code
- →Server hardening, reverse proxy and firewall setup
- →Ongoing support by arrangement
04 / skills & tech stack
What I work with
What I use day to day, grouped by area.
- Languages
Java
PHP
JavaScript- TypeScript
C
HTML5
CSS3
- Frontend
React
Astro
Android
- Backend
Node.js
MySQL
Microsoft SQL Server
- Cloud & DevOps
AWS
Docker
Nginx- GitHub Actions
- Linux
- Security
CompTIA Security+- CompTIA A+
- Secure coding
- Networking
Fibre installation- LAN & cabling
- Network configuration
- Process
- Requirements analysis
- Agile / Scrum
- Software testing
- Project management
04 / credentials & education
Certifications
Two CompTIA certifications and the diploma.
CompTIA Security+
Cybersecurity Fundamentals & Network Hardening
Valid CredentialCompTIA A+
IT Operations, Hardware & System Infrastructure
Issued 2024Diploma in Systems Development
Boston City Campus (HDIPSD2)
76% Distinction Pass05 / selected work
Selected Work
Two pieces of work I can talk about in detail.
Asante Financial Services Engine & Loan Portal
Client: Asante Financial Services (PTY) LTDThe website and loan application platform for Asante Financial Services, a South African short-term lender. I built it on my own: a multi-step loan application, a customer portal and a back office for staff. Customer PII (ID numbers, bank details, salary) is encrypted field by field with AES-256-GCM and searched through blind indexes; staff access is role-based with a TOTP or SMS second factor; there are POPIA data-subject export and deletion tools, WhatsApp and SMS notifications, and CSP, CSRF and rate-limiting middleware. I also wrote the backup and log-rotation scripts for the server.
AES-256-GCM PII EncryptionPOPIA & DSAR ComplianceSub-15ms Query LatencyRBAC & Multi-Factor Auth
Delivered Scope:
- ✓Dynamic multi-step borrower loan application engine with document upload MIME validation
- ✓AES-256-GCM field-level PII encryption architecture with blind indexing (_hash) for exact search
- ✓Customer portal with TOTP/SMS MFA, application tracking, auto-save drafts & DSAR export
- ✓Admin back-office dashboard with role-based access control (RBAC), session event tracking & audit logs
- ✓Automated WhatsApp API & WinSMS integration for instant customer status notifications
- ✓Operational shell utilities for automated MySQL backups, log rotation, cron setup & DB indexing
Architecture Flowchart
System Architecture Topology
STEP 01
Borrower Portal / Web Client
►
▼
STEP 02
Security Middleware (CSP Nonce, CSRF, RateLimiter)
►
▼
STEP 03
PHP 8 Engine (Auth, RBAC, PiiEncryptor)
►
▼
STEP 04
MySQL Relational Database (AES-256-GCM PII + 3NF)
Technical Deep-Dive & Architecture Breakdown
Overview: Security middleware (SecurityHeaders.php, RateLimiter.php), session event logging (AuditLogger.php) and role-based permissions (RbacMiddleware.php).
Data & Schema Architecture: 3NF normalized relational schema protecting sensitive PII (id_number, bank_account_number, salary_details, residential_address) with field-level AES-256-GCM encryption and blind index searching (_hash) to enable sub-15ms queries without storing unencrypted PII.
Security & Resilience: Fully compliant with South African POPIA legislation featuring Data Subject Access Request (DSAR) export utilities, automated account deletion/anonymization workflows, TOTP/SMS Multi-Factor Authentication (MfaManager.php), and automated database backup/restore scripts (backup-db.sh, restore-db.sh).
PHP 8.xMySQL (3NF)AES-256-GCM EncryptionJavaScript (ES6+)Apache / NginxTailwindCSSWhatsApp & WinSMS APIPOPIA / DSAR
Production AWS Cloud Infrastructure & Automated CI/CD Pipeline
Client: Future ProTechY / Enterprise DeploymentAWS work at Future ProTechY: a VPC with public and private subnets, security group rules, EC2 instances behind a load balancer with Nginx in front, and a GitHub Actions pipeline that builds and deploys on push.
Multi-Subnet VPC ZoningZero-Downtime DeploymentsStrict Security Group RulesNginx Reverse Proxy Tuning
Delivered Scope:
- ✓Isolated VPC architecture with public/private subnet zoning & NAT gateway routing
- ✓EC2 instance provisioning, system hardening, SSH key rotation & Nginx reverse proxy
- ✓Automated CI/CD build, test & deployment pipeline triggered via GitHub Actions
- ✓Route 53 DNS routing, ACM SSL/TLS certificate termination & automated health checks
Architecture Flowchart
System Architecture Topology
STEP 01
Route 53 / SSL Gateway
►
▼
STEP 02
Application Load Balancer
►
▼
STEP 03
EC2 Instances (Docker Container Clusters)
Technical Deep-Dive & Architecture Breakdown
Overview: Built using AWS infrastructure best practices with clear separation between public-facing entrypoints and internal compute nodes.
Data & Schema Architecture: Automated GitHub Actions runner executes linting, container builds, and SSH deployment commands to update live services smoothly.
Security & Resilience: Strict security group rules opening port 443/80 only to ALB, and port 22 restricted exclusively to VPN/bastion access.
AWS VPCAWS EC2Application Load BalancerRoute 53DockerGitHub ActionsLinuxNginx
06 / education
Education
Diploma in Systems Development (HDIPSD2)
2023 – 2026Boston City Campus, Durban, KZN
Overall average: 76%, pass with distinction
Top Results:Systems Analysis & Design (90%), Praxis (92%), Security+ (88%), Software Testing (86%), Java & MySQL (86%)
Programming:Java, PHP, JavaScript, C, HTML, Android Development
Databases:MySQL, Database Design, Implementation and Management
Security:CompTIA A+ (2024), CompTIA Security+, Ethical Hacker Pro
Business:Business Analysis, Business Process Management, Business Information Systems, Business Management, Business Ethics
Project & Professional:Software Project Management, Software Testing, Professional Skills
Diploma confirmed by the Office of the Registrar, April 2026
National Senior Certificate
2019Nombika High School, Ndwedwe, KZN
07 / experience
Work Experience
Junior Systems Developer & Cloud Engineer
May 2026 – Present- →Gaining hands-on exposure to Amazon Web Services (AWS) cloud infrastructure in a professional environment, working with VPCs, subnets, security groups, and EC2 compute instances under real-world conditions, with openness to further mentorship in this area
- →Designing, automating, and maintaining CI/CD pipelines and automated zero-downtime deployments for production software
- →Developing full-stack applications and backend services in Java, PHP, JavaScript and MySQL for financial services systems
- →Managing application performance, server monitoring, reverse proxies, and infrastructure security under strict operational standards
Fiber Installation Technician & Administrator
Mar 2026 – May 2026- →Performed fiber optic network installations and configurations at client sites across the Durban region
- →Handled administrative functions including documentation, reporting, and operational coordination
- →Worked across both technical field roles and office-based administrative responsibilities
- →Gained hands-on experience in physical network infrastructure, cabling, and ISP deployment processes
Part-Time Systems Technician
Feb 2025 – Jan 2026- →Performed system configurations, programming, and hardware/software installations across client environments
- →Worked across multiple programming languages including C and Java in a live technical support context
- →Gained exposure to static website development using Astro, a modern JavaScript-based framework
- →Supported clients with technical troubleshooting, system setup, and operational maintenance
Education Assistant
June – November 2025- →Managed data capturing, records management, and documentation within a government programme
- →Handled confidential information with full compliance and professional integrity
- →Coordinated communication between staff, management, and external stakeholders
- →Provided administrative support to ensure smooth daily operational delivery
EA Group Leader, BEEI Phase V
Jun 2025 – Nov 2025- →Led a team of Education Assistants across attendance, task delivery, and compliance reporting
- →Acted as primary liaison between programme management and team members
- →Supported onboarding, guidance, and performance monitoring of new assistants
08 / technical writing
Notes from the work
S3 upload to Lambda, defined in one CloudFormation template
A small CloudFormation stack that triggers a Lambda function when a file lands in S3, and the three gotchas worth knowing before you write it.
Building AWS Cloud Infrastructure: From Local VPCs to Automated CI/CD Pipelines
An honest breakdown of navigating the AWS learning curve — setting up VPC subnets, EC2 instances, Nginx proxies, and automated deployment pipelines.
09 / project inquiry
Start A Project
Please select a service and the level of detail you would like to provide. A detailed brief allows me to respond with a more accurate proposal; a brief enquiry is sufficient to begin a conversation.