# Portfolio context for "Ask my portfolio" This file is the knowledge the page answers from. Edit it, commit, push; no code change needed. Format: each `## Title` starts one entry. Optional lines right under it: `id:` unique slug, `url:` link shown under the answer (a path on this site, or https://...), `keywords:` comma-separated search words. Everything after that is the text the AI may use. Keep entries short (a few sentences) and only write things that are true. ## Who is Jhapendra Kandel id: about url: / keywords: who, about, developer, kathmandu, nepal, available, hire, work, engineer, jk, jhapendra, kandel, jhapendra kandel, creator, owner, author, person, yourself, name Jhapendra Kandel (J.K) is a full-stack developer, cybersecurity enthusiast and automation engineer based in Kathmandu, Nepal. He is working towards a Bachelor of Information Technology. He builds secure, scalable web applications, from custom WordPress platforms and news portals to REST APIs and self-hosted infrastructure, and keeps security part of the work from the start. He is available for work. ## Motto id: motto url: / keywords: motto, philosophy, principle, values Build with precision, secure by design, automate with purpose. The homepage line is: I build it. Then I break it. ## Focus areas id: focus url: /#about keywords: focus, interests, security, devops, ai, specialty, specialize Focus areas: ethical hacking and penetration testing; network security and secure software development; DevOps and infrastructure automation; applied AI, LLM systems and workflow automation. ## Currently learning id: learning url: /#about keywords: learning, studying, now, current, next, rag, mcp, kubernetes Currently learning: advanced LLM fine-tuning, RAG pipelines, the Model Context Protocol (MCP) and container orchestration. ## Education id: education url: /#creds keywords: education, degree, university, bit, study, student, bachelor Bachelor of Information Technology (BIT), in progress. Undergraduate study across software engineering, networking, cybersecurity, databases, operating systems and modern web technologies. ## Certifications id: certs url: /#creds keywords: certification, certifications, certificate, certified, github, google, cloudflare Certifications, all 2025: GitHub Foundations (GitHub), Google Cloud Computing Foundations (Google Cloud) and Cloudflare Fundamentals (Cloudflare). ## Competitions id: competitions url: /#creds keywords: competition, ctf, hackathon, hack astra, nutanix, forensics, rank, award Hack Astra CTF run by The Hackers Community Nepal: ranked 80th of 450 players. Also took part in the Nutanix Capture The Flag and a Digital Forensics Hackathon. ## Nepali news site (solo build) id: news url: /blog/posts/building-abc-news-solo/ keywords: news, wordpress, php, website, portal, devops, featured, solo Built a full Nepali news site alone from scratch: front end, back end, and all the server work and DevOps to deploy it and keep it running. Stack: WordPress, PHP, DevOps and automation. Featured, public project. ## Nepali text to speech id: tts url: / keywords: tts, speech, voice, audio, nepali, pytorch, text to speech Trained a speech model that reads Nepali out loud, so Nepali text can be turned into natural-sounding audio. Python, PyTorch, speech. Featured AI and machine learning project, private. ## Nepali LLM at home id: nllm url: /blog/posts/nepali-llm-at-home/ keywords: llm, nepali, language model, fine-tuning, homelab, gpu, training A language model built for Nepali, trained and served entirely on a homelab machine with a 32 GB GPU. LLM, fine-tuning, homelab. Featured AI project, private. ## Honeypot Lab id: honeypot url: /lab/ keywords: honeypot, lab, attack, detection, decoy, security, demo, classify Fire attacks at a decoy in your browser, watch them get classified, work the cases in a management portal, then see each weakness fixed and retested. Security and detection, runs in the page. A public demo. ## NetGuard DNS Monitor id: netguard url: https://github.com/jhapendra-kandel/NetGuard-DNS-Monitor keywords: dns, netguard, monitor, threat, detection, python, networking Real-time DNS monitoring and threat detection that flags suspicious lookups as they happen. Python, networking, security. Public cybersecurity tool on GitHub. ## ONSS (notes sharing) id: onss url: / keywords: onss, notes, sharing, php, mysql, bootstrap, study ONSS, the Online Notes Sharing System: upload, browse and download study notes with user accounts. PHP, MySQL, Bootstrap. A public web application. ## Video Reel Generator id: reel url: / keywords: video, reel, generator, captions, generative A model that takes a topic or a short script and builds a vertical video reel from it, adding cuts and captions on its own. Python, video, generative AI. Private. ## Voice to Text Model id: stt url: / keywords: voice, speech, recognition, asr, transcribe, audio A speech recognition model that listens to spoken audio and writes out what was said. Python, ASR, audio. Private. ## Kandel Holdings id: kandel url: / keywords: property, bills, tenants, real-time, kandel holdings Property and bill management platform with real-time updates for tenants and owners. PHP, MySQL, real-time. Private web app. ## Restaurant Management System id: restaurant url: / keywords: restaurant, orders, invoice, billing, kitchen, dashboard Order and invoice management that keeps table orders, billing and kitchen tickets in one dashboard. PHP, MySQL, JavaScript. Private. ## Notes Sharing Platform id: notesplat url: / keywords: notes, chat, students, websockets, learning, collaborative Collaborative learning platform with note uploads, browsing and real-time chat between students. PHP, MySQL, WebSockets. Private. ## Techkart id: techkart url: / keywords: shop, shopping, ecommerce, cart, checkout, techkart A full shopping website with a catalogue, cart and checkout flow on a PHP and SQL backend. PHP, SQL, JavaScript. E-commerce, private. ## Skills id: skills url: /#skills keywords: skills, skill, languages, technologies, tech stack, stack, best, strongest, html, css, wordpress, php, javascript, mysql, react, python, linux, docker, pentest, level, rating Self-rated skills out of 100: HTML5 92, CSS3 90, WordPress 90, PHP 88, JavaScript 85, MySQL 85, React 82, Python 80, Linux and server admin 78, Docker 75, ethical hacking and penetration testing 70. The ratings are the owner's own, not a test result. ## How it started id: journey1 url: /#journey keywords: start, started, begin, history, school, story Started by building small websites in school and never stopped. Along the way interest grew in how systems break, so now building and securing go together, with safety from the first line of code. ## Learning the whole stack id: journey2 url: /#journey keywords: stack, c, python, node, react, databases, full-stack Picked up the stack piece by piece: C and Python first, then databases and Node on the server, then React on the front end. Now comfortable across all of it on the same project. ## Getting into security id: journey3 url: /#journey keywords: security, ethical hacking, pentest, untrusted, input Spends time on ethical hacking, network security and penetration testing. Understanding how something can be attacked makes for better building. Treats every input as untrusted. ## Shipping real products id: journey4 url: /#journey keywords: production, real, products, shipping Products run in production: a property and billing platform, a restaurant order and invoice system, a notes app with live chat, and a DNS monitor that watches for bad lookups. ## Self-hosting and homelab id: homelab url: /blog/posts/cloudflare-tunnels-self-hosted/ keywords: homelab, self-host, self-hosted, orange pi, server, ubuntu, docker, gpu, hardware, home server Self-hosts an Ubuntu server on an Orange Pi Zero 2W at home, and runs a homelab machine with a 32 GB GPU for model training. Sets up the Docker containers, the web server and the database personally. ## What he is on now id: now url: /#journey keywords: now, current, currently, today, recent Right now spending time on training and running language models, Nepali speech models, RAG pipelines and container orchestration. ## Contact id: contact url: /#contact keywords: contact, email, reach, hire, github, linkedin, youtube, instagram, social, message Email jhapendrakandel.mac@gmail.com, or use the contact form on the homepage. Also on GitHub (jhapendra-kandel), LinkedIn (jhapendrakandel), YouTube (@Kandeljhapendra) and Instagram (jk.jk_100). Open to work and to building things that stay up. ## Hack Me and the site CTF id: hackme url: /hack-me/ keywords: hack, hack me, try, labs, door The Hack Me page points to The site is a CTF at /tools/ctf/, a live scavenger hunt with eight hidden flags. Tools at /tools/ lists twenty free browser tools. Try to hack the labs and get a personal congratulations. The Honeypot Lab shows attacks being classified in the browser. ## Nepal Internet Pulse id: pulse url: /pulse/ keywords: pulse, nepal, internet, routing, bgp, asn, outage A small public view of Nepal's internet routing: networks, announced prefixes, a 90-day trend and a hand-kept outage timeline. ## Security Wire id: security url: /security/ keywords: security wire, cve, vulnerabilities, news, headlines A live security news and vulnerability page on the site, showing recent CVEs and headlines. ## Blog: Hello from the new blog id: post-hello-from-the-new-blog url: /blog/posts/hello-from-the-new-blog/ keywords: meta, blog, post, article, wrote, written, read A short note on why this blog now lives on my own site, and how it works. Tags: Meta. Published 2026-09-03. ## Blog: Building a news site on my own id: post-building-abc-news-solo url: /blog/posts/building-abc-news-solo/ keywords: web, devops, wordpress, blog, post, article, wrote, written, read What it takes to build and run a full news site by yourself, from the theme down to the server. Tags: Web, DevOps, WordPress. Published 2026-08-20. ## Blog: Training a Nepali language model at home id: post-nepali-llm-at-home url: /blog/posts/nepali-llm-at-home/ keywords: ai, homelab, nepali, blog, post, article, wrote, written, read Notes on fine-tuning and serving a Nepali LLM on a single AMD AI Pro 32GB GPU in my homelab. Tags: AI, Homelab, Nepali. Published 2026-08-05. ## Blog: Running Large Language Models Locally: What VRAM Actually Means id: post-running-llms-locally-vram url: /blog/posts/running-llms-locally-vram/ keywords: ai, llm, homelab, blog, post, article, wrote, written, read Parameters are not gigabytes. Where VRAM really goes, why quantization works, and why a 70B model does not need 70GB. Tags: AI, LLM, Homelab. Published 2026-03-18. ## Blog: Why Nepali Is Still a Hard Language for AI Models id: post-why-nepali-is-hard-for-ai url: /blog/posts/why-nepali-is-hard-for-ai/ keywords: ai, llm, nepali, blog, post, article, wrote, written, read Thin data, tokenizers built for English, and manual evaluation. The concrete reasons Nepali still lags, and what helps. Tags: AI, LLM, Nepali. Published 2026-04-02. ## Blog: Can Multiple AI Agents Work in Parallel? Understanding Parallel Agent Architectures id: post-parallel-ai-agents url: /blog/posts/parallel-ai-agents/ keywords: ai, llm, agents, blog, post, article, wrote, written, read When running AI agents in parallel actually helps, the architecture that works, and the judging step everyone skips. Tags: AI, LLM, Agents. Published 2026-04-21. ## Blog: Cloudflare Tunnels as Part of a Self-Hosted Infrastructure id: post-cloudflare-tunnels-self-hosted url: /blog/posts/cloudflare-tunnels-self-hosted/ keywords: infra, homelab, devops, blog, post, article, wrote, written, read Exposing self-hosted services without opening ports: what tunnels buy you, how I use them, and where they fall short. Tags: Infra, Homelab, DevOps. Published 2026-05-06. ## Blog: What I Learned Designing a Multi-Layer Server Architecture id: post-multi-layer-server-architecture url: /blog/posts/multi-layer-server-architecture/ keywords: infra, homelab, devops, blog, post, article, wrote, written, read A VPS, a NAS, a backup box and some tunnels, each with one job. Why the separation happened and what it costs. Tags: Infra, Homelab, DevOps. Published 2026-05-19. ## Blog: How I Think About Backups After Designing My Own Infrastructure id: post-how-i-think-about-backups url: /blog/posts/how-i-think-about-backups/ keywords: devops, infra, homelab, blog, post, article, wrote, written, read Tiers not copies, the target pulls, keep history, test the restore. The backup model I use after building my own infra. Tags: DevOps, Infra, Homelab. Published 2026-06-03. ## Blog: Why Network Isolation Matters in a Cybersecurity Lab id: post-network-isolation-security-lab url: /blog/posts/network-isolation-security-lab/ keywords: security, homelab, infra, blog, post, article, wrote, written, read VLANs, default-deny between segments, and small-scale zero trust. Why isolation keeps a lab from becoming an incident. Tags: Security, Homelab, Infra. Published 2026-06-17. ## Blog: From Localhost to Production: Problems Nobody Mentions in Tutorials id: post-localhost-to-production url: /blog/posts/localhost-to-production/ keywords: devops, infra, blog, post, article, wrote, written, read DNS, service networking, permissions, containers and env config. The things that break the first few times you ship for real. Tags: DevOps, Infra. Published 2026-07-01. ## Blog: Why Production Engineering Is Different from Writing Code id: post-production-engineering-vs-code url: /blog/posts/production-engineering-vs-code/ keywords: devops, blog, post, article, wrote, written, read Writing code that works is the small part. Reliability, monitoring, backups, security and deployment are the rest. Tags: DevOps. Published 2026-07-14. ## Blog: What Happens When an Internet-Facing Server Gets Attacked? id: post-internet-facing-server-attacked url: /blog/posts/internet-facing-server-attacked/ keywords: security, devops, blog, post, article, wrote, written, read The constant background noise, what the attack surface really is, why logs must leave the box, and a short IR plan. Tags: Security, DevOps. Published 2026-07-23. ## Blog: Building a Security Research Assistant with Local LLMs id: post-security-research-assistant-local-llms url: /blog/posts/security-research-assistant-local-llms/ keywords: ai, security, llm, homelab, blog, post, article, wrote, written, read A private security research helper on local models: RAG for knowledge, tool calling for facts, and keeping output honest. Tags: AI, Security, LLM, Homelab. Published 2026-08-01. ## Blog: Using AI Agents for Cybersecurity: Where They Help and Where They Fail id: post-ai-agents-for-cybersecurity url: /blog/posts/ai-agents-for-cybersecurity/ keywords: ai, security, agents, blog, post, article, wrote, written, read Where AI agents genuinely help in security work, where they fail with confidence, and how to use them without getting burned. Tags: AI, Security, Agents. Published 2026-08-12. ## Blog: LLM Hallucinations in Cybersecurity: Why Verification Matters id: post-llm-hallucinations-in-cybersecurity url: /blog/posts/llm-hallucinations-in-cybersecurity/ keywords: ai, security, llm, blog, post, article, wrote, written, read Fabricated CVEs, plausible-but-wrong details, and made-up citations. Why every model claim in security work needs verifying. Tags: AI, Security, LLM. Published 2026-08-25. ## Blog: Designing a Cybersecurity AI Agent Pipeline id: post-cybersecurity-ai-agent-pipeline url: /blog/posts/cybersecurity-ai-agent-pipeline/ keywords: ai, security, agents, blog, post, article, wrote, written, read Narrow specialized agents, evidence passed between stages, and a fact-check stage that assumes every finding is wrong. Tags: AI, Security, Agents. Published 2026-09-01. ## Blog: Building an AI-Powered Threat Intelligence Pipeline id: post-ai-threat-intelligence-pipeline url: /blog/posts/ai-threat-intelligence-pipeline/ keywords: ai, security, agents, blog, post, article, wrote, written, read Collect, normalize, analyze, enrich, summarize. Turning the threat-intel firehose into a short digest, with AI as one stage. Tags: AI, Security, Agents. Published 2026-09-06.