WHO AM I?

I'm John Akhis Moreno, the person behind Yongchivo.

I design, build and ship secure software: a paid app live on the App Store and Google Play, AI tools built on Claude, and security-hardened web tools on Cloudflare.

What I can do for you

For small businesses, startups and individuals — in English or Spanish.

  • Mobile apps iOS and Android, from idea to the stores.
  • Websites Fast, bilingual and secure from day one.
  • Browser tools Small tools that run on your visitors' devices.
  • Security audits A cyber security review of what you already have.
  • Web & app audits Your site or app reviewed: code, setup and weak spots.
  • A second opinion A fresh point of view on your project or idea.
Let's talk contact@yongchivo.com

Profile

Final-year BSc (Hons) Cyber Security student at the University of Worcester (graduating 2027) who ships production software. Designed, built and released PHV Prep UK, a paid iOS and Android exam-preparation app built solo in Flutter and Firebase with server-side purchase verification and API keys kept off the client, alongside a hub of eight free cyber security tools on Cloudflare, an in-browser file converter and UNO, an orchestrator that keeps AI coding agents on a short leash. Practical experience across digital forensics, secure application design, mobile and web development, and custom Linux environments. Bilingual in Spanish and English. Working as an SIA-licensed Door Supervisor, and holder of Emergency First Aid at Work certification and a full UK driving licence. Four years of customer-facing hospitality experience have built strong communication skills, reliability and the ability to stay calm under pressure, both independently and in fast-moving teams.

Experience

Founder & Developer — Yongchivo

Apr 2026 – Present - Independent, yongchivo.com

Independent practice through which I design, build, secure and release my own software end to end. Shipped PHV Prep UK solo to the App Store and Google Play with Flutter and Firebase. Put AI to work in production and in tooling: an AI tutor on the Anthropic API with the key held in Secret Manager and never shipped in the client, and UNO, which orchestrates Claude Code agents in isolated git worktrees behind a deterministic review gate. Made security part of every build: SSRF-safe URL validation on a Cloudflare Worker, HTTP security headers raised from grade D to A, a strict Content-Security-Policy kept intact across the site, and secrets kept out of client code. Deployed on Cloudflare Workers and Pages, and used WebAssembly (libheif, FFmpeg.wasm) to run file conversion entirely in the browser. Learned to treat security as a design constraint from day one rather than a patch at the end.

Projects

UNO — Secure AI Agent Orchestrator

Python / Claude Code / Git - Private project, in development

Designed and built a tool that coordinates several Claude Code agents on one project, in parallel or as a role pipeline (developer, security analyst, architect), with a local web interface to watch the agents live and approve every change. Every agent is treated as an untrusted worker: one git worktree and branch per agent, least privilege (read/edit only, no shell, network or MCP servers), and a deterministic gate that holds out-of-scope changes, protected paths and possible secrets for review. Mitigates cross-agent prompt injection, hash-verifies role configuration before every run (TOCTOU) and locks the local interface down with a per-launch token, Origin/Host validation and a strict CSP. Verification commands (build, tests) are run by UNO itself in a clean environment, never by an agent. Covered by 200+ unit tests, a smoke test that attacks the live server and a documented threat model; used on real projects, including this site.

PHV Prep UK — Taxi Badge Exam Preparation App

Flutter / Dart / Firebase / Anthropic API - Solo project, live on the App Store and Google Play

Designed, built and released a paid exam-preparation app for West Midlands private hire vehicle (taxi badge) licensing tests (Wolverhampton, Birmingham, Solihull, Coventry, Tamworth, Sandwell, Dudley and Walsall), covering 2,000+ practice questions, timed mock exams that mirror the real exam's pass logic, and an AI tutor for UK taxi law. Built solo with Flutter and Firebase (Auth, Firestore, Cloud Functions, europe-west2). Security-focused throughout: server-side StoreKit 2 purchase verification, the Anthropic API key held in Secret Manager and never shipped in the client, Firestore rules locking premium status to the backend, and content-safety controls on the AI feature. Live on both the App Store and Google Play.

Yongchivo Tools — Cyber Security Micro-Tools

Astro / Tailwind / Cloudflare Workers - tools.yongchivo.com

Built and launched a hub of eight free, bilingual (English/Spanish) cyber security tools. Six run entirely client-side — password generator, password strength analyser, subnet calculator, cyber-role quiz, EXIF viewer and PDF metadata editor — with two backed by Cloudflare Workers: a security headers checker with strict SSRF-safe URL validation, and a breach checker built on the XposedOrNot API. Deployed with automatic builds from GitHub and its own A-grade security headers.

File Converter — Private, In-Browser

JavaScript / WebAssembly / Astro - yongchivo.com/convert

Built a privacy-first file converter that runs entirely in the browser, so no file is ever uploaded. Converts images (PNG, JPG, WebP, and HEIC via the libheif WebAssembly build), data formats (CSV, JSON, YAML, XML), PDFs (images to PDF and back, merge, split, rotate, compress) and audio and video (FFmpeg.wasm), with drag-and-drop, batch conversion and graceful handling of malformed input. Bilingual (EN/ES) on a single reusable conversion engine, without weakening the site's strict Content-Security-Policy.

Analytics Dashboard — In-Browser

TypeScript / Chart.js / Astro - yongchivo.com/analytics

Built a dashboard that reads Google Search Console, App Store Connect and Google Play Console CSV exports entirely in the browser and shows what the native dashboards don't: CTR against position, ranking distribution, conversion funnels, day-of-week performance and side-by-side comparison of two date ranges. Files never leave the user's device.

Personal Portfolio with Security Hardening

Astro / Tailwind / Cloudflare Pages - yongchivo.com

Built and maintain this bilingual (EN/ES) site with continuous deployment from GitHub to Cloudflare Pages. Hardened its HTTP security headers from grade D to A on securityheaders.com by configuring HSTS, Content-Security-Policy, X-Frame-Options and Permissions-Policy through a _headers file.

Education

BSc (Hons) Cyber Security (Single Honours)

Sept 2024 – Jun 2027 (expected) at University of Worcester, Worcester, UK

Final year; B-grade average in Year 2. Modules include Digital Forensics, Mobile Application Development, Web Technologies, networking and security fundamentals. Coursework focuses on practical investigation techniques, secure design and modern application development.

BTEC Level 3 National Extended Diploma in Information Technology

2022 – 2024 at Sandwell College, Central Campus, Birmingham, UK

Overall grade: MMP. Merit grades in IT Systems, Creating Systems to Manage Information, Mobile Apps Development, Software Testing, Programming, Using Social Media in Business and IT Project Management. Pass grades in Cyber Security and Incident Management, IT Service Delivery, Website Development, IT Technical Support, Computer Games Development and Digital Animation.

Academic Projects

BlackDogHunter — 2D Game

Unity / C# - Academic project, University of Worcester

Designed and built a complete 2D game in Unity using C#, covering game mechanics, sprite animation, scene management and level design.

University Kiosk Operating System

Linux / Ubuntu - Academic project, University of Worcester

Built a locked-down kiosk OS based on Ubuntu, configuring auto-login, a restricted user environment and start-up scripts to deliver a reliable single-purpose public terminal.

MyLocation — Mobile Application

Android / Java / Kotlin / Firebase - Academic project, University of Worcester

Developed a location-aware mobile app backed by Google Firebase, including user authentication and real-time data storage to sync locations and events.

E-Commerce Web Pages

HTML / CSS / JavaScript

Designed and built responsive e-commerce front-end pages, including product layouts, navigation and interactive elements.

Other Experience

Door Supervisor at Pavilon Security

Jul 2026 – Present in the West Midlands, UK

SIA-licensed door supervision across the West Midlands, mainly at pubs and events, as well as film premieres and CCTV control at warehouses (paused during term time). Responsible for access and capacity control, ID checks, conflict management and incident reporting.

Bartender at Sabai Sabai

Apr 2024 – Mar 2026 in Birmingham, UK

Prepared and served cocktails, coffees, spirits and beer to a high standard in a busy Thai-restaurant bar. Handled cash and card payments accurately, reconciled tills at end of shift, and carried out weekly beer-line cleaning, daily bar hygiene and stock checks to brewery and food-safety standards. Verified customer ID under Challenge 25 and applied responsible-service procedures.

Bartender & Kitchen Porter at Tapas Revolution

2021 – 2023 in Birmingham, UK

Bartender (~24 months) and Kitchen Porter (4 months). Served cocktails, wine, beer and spirits in a high-volume Spanish restaurant, switching between English and Spanish to support customers and team members. Took customer payments and operated the till during peak services. As Kitchen Porter, supported chefs with food preparation, dishwashing and kitchen hygiene.

Certifications & Licences

  • SIA Door Supervisor Licence — Valid to 30 September 2028
  • Highfield Level 2 Award for Door Supervisors in the Private Security Industry (RQF) — June 2025
  • Highfield Level 3 Award in Emergency First Aid at Work (RQF) — May 2025 (valid 3 years)
  • ACT Awareness e-Learning — Counter Terrorism Policing / NaCTSO, June 2025
  • ACT Security e-Learning — Counter Terrorism Policing / SIA, June 2025
  • Full UK Driving Licence

Skills

Security & Forensics

  • Digital Forensics
  • Incident Response
  • Security Operations
  • Secure Application Design
  • Web Security Headers (CSP / HSTS)
  • SSRF Mitigation
  • Secrets Management
  • ACT Counter-Terrorism

Development

  • Dart (Flutter)
  • C# (Unity)
  • Java / Kotlin (Android)
  • JavaScript
  • TypeScript
  • WebAssembly
  • HTML
  • CSS
  • Python (basics)

Operating Systems & Tools

  • Linux (Ubuntu)
  • Windows
  • Git & GitHub
  • Firebase
  • Cloudflare Workers & Pages
  • Astro
  • Tailwind CSS
  • Unity
  • Microsoft Office

Languages

  • Spanish — Native
  • English — Fluent

Soft Skills

  • Customer service
  • Cash handling
  • Conflict de-escalation
  • Teamwork
  • Time management
  • Bilingual communication

How I work

  • Methodical: I make a solid plan and follow it to the letter.
  • Self-critical: at the end I look for the gaps in my own ideas, then improve or reinvent them.
  • Security from the start, not as a patch at the end.
  • Bilingual: Spanish and English, so your project can reach both markets.
  • Close and direct: you talk to the person doing the work.

Where I'm heading

I want to grow Yongchivo into a big brand: freelancing for small businesses, startups and individuals under the Yongchivo name, and one day leading a team to take on even bigger projects. Got an idea?

Let's talk

My story

I was born and raised in Málaga. In 2019 I had to repeat a year at school, and my dad — who was already living in the UK — suggested I come to Birmingham and give it a go. I wasn't sure at all: it was a huge change, and it was. But back then I was lost, and Birmingham turned me around. It helped me discover a lot of things, and above all, myself.

I started at Sandwell College in West Bromwich in late October, with the year already under way, and stayed three years. I'd never pictured myself at university, but there I realised I could do it. Today I'm in the final year of a BSc in Cyber Security at the University of Worcester. Málaga is still home: my family is there, and it's a city — and Spain a country — I'll always love.

  1. Málaga Where it all started
  2. Birmingham 2019 — a fresh start
  3. Sandwell College Three years in West Bromwich
  4. University of Worcester BSc Cyber Security — final year

Why “Yongchivo”?

It comes from “baby chivo” — the young goat, the young promise. The name was born in my streaming days, inspired by a song by Yovngchimi and Ñengo Flow, and today it's the brand behind everything I build.

From the PlayStation to cyber security

It all started with a PlayStation 1. I grew up on True Crime and GTA: San Andreas on the PS2, Minecraft and Far Cry 4 on the PS3, Black Ops 3 and ARK on the PS4 and Cyberpunk on the PS5 — and from consoles I moved on to phones, tablets and computers, picking up image and video editing along the way.

At college, of everything in computing, security was what hooked me: gathering information and evidence, understanding attacks and building the defences and countermeasures against them. That's why I chose to study Cyber Security.

Away from the screen I work in security too: I'm an SIA-licensed Door Supervisor at Pavilon Security, at pubs, events and film premieres across the West Midlands.

Beyond the code

  • Gym & training
  • Sport
  • Podcasts
  • Music
  • Time with friends
  • A good debate
  • Video editing

Video editing is my art form: I don't play an instrument, sing or draw, but I can express myself through an edit.