# Hafiq Iqmal

> Senior backend engineer and tech lead based in Selangor, Malaysia with 10+ years designing secure, scalable systems for enterprise and government platforms. Specialises in API-first architecture, Laravel, cloud infrastructure (AWS, Alibaba Cloud), and DevSecOps. Writer on software engineering, system design, AI tools, and engineering leadership.

## About

Hafiq Iqmal is a Lead Back-End Developer, Tech Lead, and Solution Architect who has delivered production systems for government agencies (JAKIM, LTAT, MAIWP, Air Selangor, SAMB) and enterprise clients across Malaysia. He writes about backend engineering, Laravel, system design, security, and the human side of software development.

- Website: https://hafiq.dev
- Blog: https://hafiq.dev/blog
- GitHub: https://github.com/afiqiqmal
- LinkedIn: https://www.linkedin.com/in/hafiq93
- Medium: https://medium.com/@hafiqiqmal93

## Key Pages

- [Portfolio Home](https://hafiq.dev): Overview of skills, experience, and featured projects
- [Work & Projects](https://hafiq.dev/work): Detailed case studies of enterprise and government projects
- [Blog](https://hafiq.dev/blog): 170+ technical articles on backend engineering, Laravel, system design, AI, and career
- [Tools](https://hafiq.dev/tools): 79+ free developer tools (JWT decoder, UUID generator, regex tester, and more)
- [RSS Feed](https://hafiq.dev/rss.xml): Subscribe to new blog posts

## Recent Blog Posts

- [Why EXPLAIN Has to Review AI-Written SQL](https://hafiq.dev/blog/why-explain-has-to-review-ai-written-sql-079bc4756e7b) — Correct syntax is easy. The expensive mistake is the query plan nobody checked.
- [S3 vs Spaces vs R2: What Small Teams Actually Need](https://hafiq.dev/blog/s3-vs-spaces-vs-r2--what-small-teams-actually-need-489cec969226) — Laravel makes the switch look trivial. Your network path, egress bill and edge plan decide whether it really is.
- [The Laravel Workflow That Makes AI Feel Like a Teammate](https://hafiq.dev/blog/the-laravel-workflow-that-makes-ai-feel-like-a-teammate-05a1c1312370) — Acceptance does not start with trust. It starts with a five-minute spec, written project rules and review habits that keep your judgment in…
- [How Team Leaders Remove AI Skepticism From Their Developers](https://hafiq.dev/blog/how-team-leaders-remove-ai-skepticism-from-their-developers-cce56bf1f716) — Developers stop rolling their eyes at AI when leads stop selling hype and start changing the daily environment around the work.
- [Building an Agentic OCR Pipeline With Laravel AI SDK](https://hafiq.dev/blog/building-an-agentic-ocr-pipeline-with-laravel-ai-sdk-487144978723) — The agent coordinates the workflow. Your PHP code owns the verdict.
- [I Thought Speed Made Me Lead Material. It Didn’t.](https://hafiq.dev/blog/i-thought-speed-made-me-lead-material--it-didn-t--e95280e1949a) — The habit that made me useful as a senior engineer became expensive the moment other people depended on it.
- [Prompt to Loop: How Fast AI Engineering Grew Up](https://hafiq.dev/blog/prompt-to-loop--how-fast-ai-engineering-grew-up-ba31c5d924df) — In roughly three years, the hard part moved from wording prompts to designing context, tools, harnesses and feedback loops.
- [AWS Recommends RDS. A $6 Droplet Works Fine. Here Is Why.](https://hafiq.dev/blog/aws-recommends-rds--a--6-droplet-works-fine--here-is-why--700d1389d727) — The managed database overhead that only makes sense when your team has an on-call rotation.
- [Building a File Upload Scanning Pipeline for Laravel and S3](https://hafiq.dev/blog/building-a-file-upload-scanning-pipeline-for-laravel-and-s3-afae7b9e73e4) — Direct uploads solve throughput. They do nothing to stop malicious files.
- [How to Actually Answer the CDN Caching Question](https://hafiq.dev/blog/how-to-actually-answer-the-cdn-caching-question-633d4b54137e) — HTTPS does not stop edge caching. It forces you to define trust boundaries and cache scope.
- [What Laravel upsert() Actually Guarantees in Production](https://hafiq.dev/blog/what-laravel-upsert---actually-guarantees-in-production-c6e65f07844c) — One SQL statement fixes the duplicate row. The email, job and cache write still need their own discipline.
- [S3 Presigned Uploads vs Proxy Uploads: What Breaks First](https://hafiq.dev/blog/s3-presigned-uploads-vs-proxy-uploads--what-breaks-first-6318be1106e4) — Direct uploads remove pressure from your app servers. They also move trust into places teams rarely inspect.
- [Everyone Works in IT Until the Customer Asks Technical Questions](https://hafiq.dev/blog/everyone-works-in-it-until-the-customer-asks-technical-questions-222b49a3ca05) — When Everyone avoid the technical layer, the tech lead becomes the translation department.
- [A/B Testing in Laravel: The Easiest Reliable Setup](https://hafiq.dev/blog/a-b-testing-in-laravel--the-easiest-reliable-setup-8e716faa5a2c) — Stable bucketing, one cookie and tracking you can trust.
- [The Part Tech Leaders Skip When They Say AI Makes Developers More Efficient](https://hafiq.dev/blog/the-part-tech-leaders-skip-when-they-say-ai-makes-developers-more-efficient-f5de49a9028d) — AI adoption is not just a tooling decision. It changes the staffing equation, and many leaders avoid saying that part clearly.
- [Vibe Coding Only Works If You Already Know How To Code](https://hafiq.dev/blog/vibe-coding-only-works-if-you-already-know-how-to-code-77ec481fe849) — The model can generate syntax, scaffolding and even passing tests. It still cannot replace the judgment that decides whether the patch is…
- [The PostgreSQL Guide to Partial Indexes on Soft Deletes](https://hafiq.dev/blog/the-postgresql-guide-to-partial-indexes-on-soft-deletes-cc412a29bae3) — If every hot query ignores deleted rows, stop paying to index them.
- [How Laravel chunk() Starts Skipping Rows in Production](https://hafiq.dev/blog/how-laravel-chunk---starts-skipping-rows-in-production-ae30e8e4fabe) — The safer iterator is not the flashiest one, it is the one that keeps your result set stable while you mutate it.
- [PHP Is Not Why Your Laravel App Feels Slow](https://hafiq.dev/blog/php-is-not-why-your-laravel-app-feels-slow-666eac2c175a) — The real damage usually comes from lazy loading, synchronous work, and optional caching.
- [Read Replicas Are Not a Scaling Plan. They Are a Consistency Trade-Off.](https://hafiq.dev/blog/read-replicas-are-not-a-scaling-plan--they-are-a-consistency-trade-off--92ae26ff3c9e) — They remove read pressure, but they also move stale data into places users notice fast.
- [Stop Obsessing Over Tools. Start Showing How You Decide](https://hafiq.dev/blog/stop-obsessing-over-tools--start-showing-how-you-decide-1a8b9d02ddde) — The upgrade senior engineers notice is not your stack. It is your decision trail.
- [What Actually Makes a Coding Agent Safe at Work](https://hafiq.dev/blog/what-actually-makes-a-coding-agent-safe-at-work-f5cdad1692b4) — Good code is not the bar. Bounded permissions, verification and rollback ownership are.
- [Not Every Deployment Problem Needs Kubernetes](https://hafiq.dev/blog/not-every-deployment-problem-needs-kubernetes-e989bc907177) — Sometimes the mature answer is not the most advanced infrastructure. It is the simplest setup that safely fits the application, team and…
- [The Small-Team Guide to AI-Driven Development Without Review Collapse](https://hafiq.dev/blog/the-small-team-guide-to-ai-driven-development-without-review-collapse-e43fd4c8d4bd) — Code gets cheaper first. Judgment does not.
- [AIDD vs TDD vs DDD: They Drive Different Layers](https://hafiq.dev/blog/aidd-vs-tdd-vs-ddd--they-drive-different-layers-e00f08319a28) — AI did not retire the old acronyms. It changed where they belong.
- [Laravel’s ShouldBeUnique Does Not Make a Job Idempotent](https://hafiq.dev/blog/laravel-s-shouldbeunique-does-not-make-a-job-idempotent-fb67525bb024) — Queue de-duplication stops overlap. Idempotency survives retries, crashes and replay.
- [Refresh Token Rotation vs JWT Blacklists: What Logout Really Costs](https://hafiq.dev/blog/refresh-token-rotation-vs-jwt-blacklists--what-logout-really-costs-dc085b3eec8c) — Both patterns add server state. The real question is when you want to pay for it.
- [How a composer install Becomes Remote Code Execution: Inside CVE-2026–40261 and CVE-2026–40176](https://hafiq.dev/blog/how-a-composer-install-becomes-remote-code-execution--inside-cve-2026-40261-and-cve-2026-40176-e4d56f94f57c) — Two Composer CVEs from April 2026 that run attacker commands on any PHP developer’s machine, without Perforce installed
- [3 Ways to Design a Password Reset Flow. Most Teams Only Know One.](https://hafiq.dev/blog/3-ways-to-design-a-password-reset-flow--most-teams-only-know-one--3574e43810d9) — How each approach works, what it protects against, and when to reach for which one.
- [Building a Password Reset System That Does Not Leak Accounts](https://hafiq.dev/blog/building-a-password-reset-system-that-does-not-leak-accounts-b477992a4280) — The hard part is not sending the email. It is controlling every trust boundary around it.

## Tools

- [AES Encrypt / Decrypt](https://hafiq.dev/tools/aes-encrypt-decrypt): Encrypt and decrypt text using AES-256-GCM with PBKDF2 key derivation, all in-browser.
- [API Tester](https://hafiq.dev/tools/api-tester): Send HTTP requests with custom headers and body, and inspect responses with timing.
- [Aspect Ratio Calculator](https://hafiq.dev/tools/aspect-ratio): Calculate dimensions while maintaining aspect ratios with common presets.
- [Bahasa Rahsia](https://hafiq.dev/tools/bahasa-secret): Encode and decode text using Malaysian secret languages (Bahasa F, M, P, S, K) by inserting syllable echoes.
- [Base64 Encoder / Decoder](https://hafiq.dev/tools/base64): Encode text or files to Base64 and decode Base64 strings back to plain text.
- [Base64 Image Converter](https://hafiq.dev/tools/base64-image): Convert images to Base64 data URIs and preview Base64-encoded images with size info.
- [CSS Box Shadow Generator](https://hafiq.dev/tools/box-shadow): Visually design CSS box shadows with multiple layers, live preview, and copy-ready CSS.
- [Chmod Calculator](https://hafiq.dev/tools/chmod-calculator): Calculate Unix file permissions with an interactive checkbox grid and octal/symbolic output.
- [Code Screenshot](https://hafiq.dev/tools/code-screenshot): Create beautiful code screenshots with syntax highlighting, themes, and window chrome.
- [Color Converter](https://hafiq.dev/tools/color-converter): Convert between HEX, RGB, and HSL color formats with live preview and CSS snippets.
- [Cron Expression Builder](https://hafiq.dev/tools/cron-builder): Build and understand cron expressions with an interactive visual editor and presets.
- [Diff Checker](https://hafiq.dev/tools/diff-checker): Compare two texts side-by-side with color-coded additions, removals, and unchanged lines.
- [EV vs ICE Cost Comparison](https://hafiq.dev/tools/ev-ice-comparison): Compare total cost of ownership between electric and gas vehicles over time.
- [Expense Splitter](https://hafiq.dev/tools/expense-splitter): Split expenses among friends with equal, exact, or percentage splits and a settlement plan.
- [Fake Data Generator](https://hafiq.dev/tools/fake-data-generator): Generate realistic fake data for people, emails, phones, addresses, and companies in JSON or CSV.
- [Favicon Generator](https://hafiq.dev/tools/favicon-generator): Upload an image and generate favicons in all standard sizes with HTML link tags.
- [File Hash Verifier](https://hafiq.dev/tools/file-hash-verifier): Compute MD5, SHA-1, SHA-256, and SHA-512 hashes of any file and verify against expected values.
- [Freelance Rate Calculator](https://hafiq.dev/tools/freelance-rate-calculator): Calculate your freelance hourly rate based on income goals, taxes, and expenses, plus side hustle analysis.
- [Hash Generator](https://hafiq.dev/tools/hash-generator): Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of any text input.
- [HTML Entity Encoder / Decoder](https://hafiq.dev/tools/html-entity): Encode and decode HTML entities for special characters and non-ASCII text.

## Topics Covered

Backend Engineering, Laravel, PHP, API Design, System Design, Database Optimisation, DevSecOps, Cloud Infrastructure, AWS, Nginx, Docker, Kubernetes, Redis, PostgreSQL, MySQL, Security, Agile, Engineering Leadership, Tech Lead, Career Advice, AI Tools, Code Review, Performance Optimisation