School management system

The school

KAFA Masjid Al-A'laa Lokub runs KAFA (Quran and Fardu Ain) classes for primary school children at the mosque. Before this, student records and fees were kept in spreadsheets, and updates went out through WhatsApp groups. Information was scattered across files and chats, and hard to keep up to date.

I built the system as the full-stack developer of a university service-learning (SULAM) team, in about a month.

What I built

A school management system with 29 modules, in use by more than 80 students and their families:

• Academics. Classes, subjects and results.
• Attendance. Daily attendance for every class.
• Fees and finance. Fees, payments and the school's finances.
• Notifications. Updates to parents.
• Parent and student accounts. Parents are linked to their children and see only their own family's records.

Making it safe for real families

A system that holds children's records and handles payments has to be secure, so I audited it myself and fixed all 16 findings, including:

• a race condition in payments that could have recorded the same payment twice,
• cross-site scripting in the print views.

It serves HTTPS only (TLS 1.2 or newer, with HSTS) and has an A+ rating on SSL Labs.

Running it

The system is self-hosted on my home lab, NOVAFORTRESS, behind Cloudflare Tunnel, so no ports are open on my home network. Deploys are automated, scheduled jobs run on their own, backups are encrypted and taken daily, and custom alerts tell me when something needs attention.

Recognition, and after the course

Our team won Anugerah Pembentang Sistem Terbaik (best system presenter) at Program Pendigitalan Pengurusan Masjid, DUN Karambunai, in June 2026. I presented the system.

When the course ended, I kept maintaining it as a volunteer: fixing issues, hardening security and adding features the school asked for.

Stack: Laravel 11, Next.js 16, MySQL 8, Nginx, Cloudflare Tunnel.