Vladislav Malinovsky
I take a task end to end and ship it to production: backend, frontend, infrastructure and support. Core stack — TypeScript/JavaScript and PHP; my own projects also run on Python and Rust. Experience spans corporate systems as a staff engineer and full-cycle solo work: bots, desktop apps, distributed systems, open-source tools.
- 6 yrs of commercial development
- 13 projects in the portfolio
- 6 built solo — from idea to production
- open source AMS — a Rust tool for AI agents
tech stack
experience
CCET · Middle PHP / Full-Stack Developer
Oct 2024 — now- Project 1 · legacy-devel (NDA)
- Project 2 · m10n (NDA)
Exprus LLC · Head of IT
Sep 2021 — Oct 2024 · 3 yrs 1 mo- managed the company IT infrastructure: network, servers, software, workstations
- Laravel CRM + a self-hosted Asterisk PBX (external lines via Zadarma SIP trunks): stood up and configured the PBX, designed and built the integration, grew it for 3 years
- two corporate portals (Laravel 8 and Yii2): personal accounts, custom CMS, Bitrix24 leads — development and support
- two WordPress sites — maintenance and feature work
- CI/CD on GitLab Runners with Docker for Yii2 and Laravel
- a Twitch GUI extension (EBS) and a Twitch API / EventSub service
Freelance · individual practice
Jun 2020 — now · in parallelweb projects, bots and tools on request alongside full-time work.
key projects
Symfony 6.4 Monorepo (NDA)
2024 — nowA large internal company platform — several related apps on a shared kernel, used by employees every day. Legacy code moves to a modern stack without downtime, data changes are transparent, reports build themselves.
role: Middle PHP / Full-Stack Developer (CCET): legacy refactoring, shared kernel, DB, CI.
- migrating legacy code (raw PHP) to modern Symfony — DI, attribute controllers, Doctrine; old modules keep working, no "big bang"
- two DBMS in one app (PostgreSQL + MariaDB), custom Doctrine types for non-standard data structures
- DB change auditing: who changed what and when — with sensitive-field protection
- template-driven report generation — dozens of report types with no code changes
- quality held by CI: static analysis (PHPStan level 8), tests isolated in transactions
Corporate IS on Hapi.js (NDA)
2024 — nowA corporate system for internal staff and external partners with strict access separation. Partners only ever see their own API, never internal data; heavy operations don't slow users down.
role: Middle Full-Stack Developer (CCET): backend routes, partner API, optimization.
- built and optimized backend routes: an internal API plus a separate public API with its own auth for partner integrations
- refactored large business-logic files and optimized SQL queries — behavior unchanged, readability and speed improved
- heavy background jobs go to a queue — user requests never block
- integrations with external data-verification services
- five PostgreSQL connections to different schemas and databases; migrations versioned separately per domain
CRM + Asterisk PBX · Exprus
2021 — 2024A CRM for a legal-expertise company with a self-hosted Asterisk PBX: a deal is tracked from lead to post-delivery warranty support, with telephony right in the browser. Managers see the whole funnel — lead source and quality, payments, court instances per case — and call from the CRM with a client card pop-up.
role: Head of IT: stood up the PBX, designed the telephony from scratch and grew the system for 3 years.
- the full funnel: lead (source, quality, qualification checklist) → deal (payments, refunds, debt) → service with court-instance tracking up to the Supreme Court and warranty letters
- stood up and fully configured a self-hosted Asterisk PBX: dialplan, internal numbers and groups, IVR scenarios, queues; external lines via Zadarma SIP trunks
- designed and built the CRM ↔ telephony integration from scratch: call events, history and recordings, missed calls, dial-outs
- a WebRTC softphone right in the CRM browser tab and a client card pop-up on incoming calls
- template-driven tasks with schedules, Telegram notifications, roles and permissions, Excel report export
Forensic Experts SRO Portal · exprus.ru
2021 — 2024A corporate portal of a self-regulatory organization: expert registry with regional search, personal accounts for individuals and companies, applications for membership, training and certification. Site applications instantly become Bitrix24 leads, and content is managed through a custom CMS with version history — the site lives without a programmer.
role: Head of IT: development, support, CI/CD.
- expert personal accounts: profile, documents, cases, vacancies; registration with email confirmation and 2FA
- custom CMS: pages with version history and rollback, blog, banners, reference data
- application funnel: membership, training and certification forms flow through queues into Bitrix24 as leads
- email campaigns via queues and Unisender, DKIM-signed mail; report export to Excel and PDF
- security: IP logging and blocking with geolocation, user action log
Multi-tier Yii2 Portal · Exprus
2021 — 2024A company portal: a public site for forensic-expertise services, role-based personal accounts (lawyer, employee, commission member) and an admin panel. Applications from ~20 forms flow into Bitrix24 as leads, lawyers manage orders and payouts in their own account, content is edited without a developer.
role: Head of IT: development, support, feature work.
- four applications on a shared codebase: public site, personal account area, admin panel and console cron jobs
- RBAC with 7 roles — lawyers, employees and commission members each get their own account area and permissions
- order and agent-payout accounting for lawyers: statuses from "paid" to "paid out", commissions
- a custom EAV layer — flexible entity attributes without DB migrations
- integrations: Bitrix24 (leads with UTM tags), SMS account verification, Google Drive, GeoIP
own & freelance projects
AMS — code index for AI agents
2026 — nowAn open-source CLI tool: indexes a codebase into SQLite and answers an AI agent's navigation queries with compact signatures and exact line spans. The coding agent stops reading whole files: on the VS Code repo (11,676 files) an answer fits in 1.6 KB — a measured token saving of hundreds of times.
role: Solo: core, CLI and a Claude Code plugin. Source is public on GitHub.
- a single Rust binary with no daemons or external dependencies: tree-sitter parsing, SQLite index
- understands 10 languages: TypeScript/JS, Rust, Python, Go, PHP, Java, Kotlin, C#, Ruby
- queries: file signatures, definition lookup, who calls a symbol, reverse dependencies, import cycles
- the index self-heals on every query via blake3 hashes — never stale, no rebuild step
- a Claude Code plugin; MIT/Apache-2.0 license, one-command install
Fortuna Team — website and CMS
2026 — nowA website for the Fortuna Team media crew (game servers, events, streams) and a mini-site for its FortunaCraft Minecraft server with its own theme, plus a custom CMS. The team edits cases, projects, partners, influencers and SEO in the admin panel themselves: publishing rebuilds the static site and swaps the release with no developer and no downtime.
role: Freelance commission, solo: Figma-to-code, responsive layout and motion, CMS, deployment.
- pixel-perfect Figma implementation with scripted geometry checks (±2 px at 1920); tablet and phone layouts designed from scratch — the mockup has none
- pages are baked into static HTML at build time (prerender): the server renders nothing on the fly and never calls the CMS — nginx serves ready files; AVIF/WebP images per width, subset fonts; Lighthouse desktop 98–100, accessibility / best practices / SEO — 100
- animations with no libraries — CSS and scroll-driven animations: headings fly in letter by letter, brush strokes draw along their curve, handwritten captions are written stroke by stroke, frames trace themselves; with reduced motion everything is visible at once and still
- influencer card — a modal over the landing page with its own URL; opening the link directly serves a separate prerendered page
- custom CMS: versioned drafts with a live preview at three widths, image cropping and optimization; publishing rebuilds the site and swaps the release with rollback
- automated Playwright checks: e2e (anchors, menu, slider, form), axe for WCAG 2.2 AA, Figma geometry, compatibility with Safari 15.4, Chrome 109 and Firefox 115, a prod build run in Docker; CMS server tests
Minecraft Launcher with auth
2026 — nowA Minecraft desktop launcher with its own auth server — a full replacement for the official Mojang login. Players install and update the game in one click; login, sessions and client integrity are secured to production standards.
role: Solo: launcher, auth server, admin panel and game agent.
- designed and built the whole stack: Tauri 2 launcher (Rust + React), Rust/Axum auth server, React admin, Rust WebSocket agent
- own Yggdrasil-compatible auth server with authlib-injector; sessions in Redis
- security: Argon2id with timing-attack protection — the hash is computed even for a non-existent user
- automatic mod install and updates: sync via SHA-256 manifest, only changed files download
- forgery protection: updates are ed25519-signed — neither game files nor the launcher itself can be tampered with
- anti-cheat: a client-side mod checks integrity of critical game files in memory, a server-side agent manages whitelist/ops/bans via RCON
Minecraft Modding — Forge mods
2026 — nowServer- and client-side Forge 1.20.1 mods for game servers: PvP mechanics, player UI, moderation tools. The server gets its own mechanics and UI built for the project instead of a pile of third-party mods; the logic is covered by tests before it reaches players.
role: Solo: mechanics, network protocol, UI and tests.
- Conquest — territory wars: teams, zone-control sieges, a token economy, chunk protection; all logic is server-side, clients only receive state snapshots; ~650 unit tests plus GameTests
- FortunaCraft Tab — a custom Tab menu replacing the vanilla one: TPS/FPS/ping, player statuses (stream, AFK, recording), auto-AFK from mouse activity, name tag hiding; a public API for other mods
- Vanish — moderator invisibility built on Mixin: full and partial hiding from Tab and the world, no join/leave or advancement messages, mobs ignore the player, separate name tag hiding
Fleet-bot automation
2026 — nowA distributed system running ~40 computer-vision game bots: a single control plane and an operator panel. The bot fleet runs itself; operators see every bot's state in real time and only step in on failures.
role: Solo: control plane, CV bot and operator panel.
- central control plane (Bun/Hono) for ~40 Windows daemons: configs, commands, telemetry
- bots natively control the mouse/keyboard and capture the screen of Windows machines
- Python bot with computer vision (OpenCV) and a hexagonal architecture: CV stages, navigation, combat
- operator panel in SvelteKit 5 + Tailwind v4 with realtime WebSocket sync
- test coverage: 500+ bun tests, nearly 1000 pytest, 300+ vitest
- layer boundaries enforced by importlinter — an IO-free domain
DocuMan — deals & contracts
in developmentA web system for running deals, contracts and document flow with roles and a timeline. Deals, documents and signing live in one place — with access control and e-document exchange.
role: A freelance commission — built entirely: from requirements to production.
- deals and contracts: RBAC, file storage (S3), timeline interface
- a deal warranty lifecycle — statuses tracked all the way through warranty expiry, not just "open/closed"
- contracts and addenda — an addendum can only be a child of a single parent contract
- integration with Kontur.Diadoc for electronic document exchange, RS256 JWT auth
Klado4nik — Twitch RPG bot
2025 — nowA text RPG right inside Twitch chat: raids, inventory, leveling, trading. Viewers play without leaving the chat — the stream feels livelier and the audience stays longer.
role: The whole bot, end to end.
- idle RPG in chat: raids, statuses, inventory, leveling, trading
- natural-language commands — a chat phrase is parsed by a local LLM into an action plan (raid, trade, purchase) with confirmation before it runs
- DDD architecture: clean domain, app layer with per-player asyncio locks, Unit of Work
- balance moved to a JSON config — tuned without DB migrations
- live admin panel over websocket — inspect data and run test commands in real time, no bot restart needed
Clips of the Year — voting
2024 — nowA site to vote for the best Twitch clips of the year, entirely on Cloudflare Workers. Fair voting without fraud — everything runs fast and reliably worldwide, with no separate server.
role: Frontend and backend on Workers.
- static frontend + Cloudflare Worker backend, data in D1 (SQLite)
- login via Twitch implicit-flow OAuth; identity by Twitch User ID with no own user tables