2025 to 2026 · Product
Aemyon Wave
Aemyon Wave is the product suite we build at Aemyon, and I lead its development and security. It grew out of nine editions organising Queima das Fitas and Festa das Latas, Coimbra's two biggest student festivals, and both now run on it: TicketWave for accreditation, tickets and the gates, StockWave for the drinks and consumables that every bar and núcleo draws on, and BoardWave for tracking the team's work.
The problem
A festival of this size runs for several nights, with thousands of people through the gates each night and many bars drawing on one shared stock. Organisers need to know who may enter, on which day and through which gate, and how much stock each bar has taken, in real time and with an audit trail that holds up afterwards. All of it touches personal data and money.
The approach
TicketWave handles accreditation (groups, profiles, badges and parking passes laid out in a drag-and-drop template editor) and ticketing (invites and paid tickets per day or for any day, with Stripe checkout and refunds), and admits them at the gate through paired scanner devices; a database constraint means two scanners can never admit the same ticket on the same day. StockWave runs each event through allocation, review and operations phases, with pickup and return QR codes that expire after minutes and work once, live preparation dashboards, a soft-drink to alcohol ratio check, fines, nightly usage predictions and report bundles in PDF, Excel and JSON. BoardWave is a Jira-style tracker with sprints, burndown, epics and a when, if, then automation engine. Security runs through all three: personal fields are encrypted and only searchable through keyed hashes, QR codes are opaque random tokens rather than anything derived from an ID number, every change is audit-logged with sensitive values masked, logins sit behind Cloudflare Turnstile with rate limits and lockouts, and BoardWave's data is guarded by Postgres row-level security.
Results
- 01TicketWave and StockWave run Queima das Fitas and Festa das Latas; at one event the gates recorded 20,210 scans, 19,796 of them accreditation badges.
- 02StockWave keeps a separate database per festival and switches between them without a restart.
- 03Over 550 commits across the three platforms since December 2025 and 44 automated test files; TicketWave and StockWave run in English and European Portuguese.
- 04All three are self-hosted on infrastructure I run, behind Cloudflare and nginx, with rate limiting in the applications.
