Modernising legacy PHP into maintainable, tested, idiomatic Laravel, with an eye on application security. Focus on code that stays readable and safe over time: thin controllers, authorisation in policies, declare(strict_types=1), PHPStan level 6, CI on every push.
- food-diary — a self-hosted food diary in Laravel. A vision model names the dishes; the numbers come from nutrition databases or your own corrected entries, never invented by the model. Multi-user, with per-user isolation enforced by the shape of the tables rather than by code. Six tagged releases, live on Railway.
- legacy-php-to-laravel — a 2010-era procedural CMS and its Laravel rewrite, side by side. Catalogued findings, a strangler-fig migration plan, and a transparent MD5 to bcrypt password upgrade on login. Built to be read in 90 seconds.
- laravel-legacy-password-upgrader — a small Laravel package that transparently upgrades legacy MD5/SHA1 password hashes to bcrypt on login. Tested, PHPStan level 6, CI on Laravel 12.
- login-defense — progressive login protection: attempt tracking, captcha escalation, timed lockout. Framework-agnostic core on PSR interfaces, thin Laravel bridge — the core test suite runs with no framework installed.
- transcriber — self-hosted transcription for audio and video. Whisper runs locally in a container, so the file never leaves the machine; the offline claim is verified in the README rather than asserted. Queued jobs, streamed progress, two selectable models.
PHP 8.3 · Laravel · PHPStan / Larastan · Pint · PHPUnit · Docker · GitHub Actions · Application Security