CredVigil
Open-source · Go · DevSecOps
2025 – Present
An open-source credential secrets scanner written in Go. Scans codebases, config files, git history, and live file changes for exposed credentials across 75+ platforms using triple-signal detection.
369 detection rulesShannon entropyBPE scoringZero-trust pipelineGit history scanningGo
- Triple-signal confidence scoring — regex pattern matching (369 rules across 75+ categories), Shannon entropy analysis, and BPE token efficiency scoring combined into a 0–100% confidence score per finding.
- Five-stage zero-trust post-processing pipeline: hash → redact → enrich → fingerprint → sanitize. Raw secrets never written to disk or output.
- Modular architecture with five independently tested components: detection engine, secure pipeline, git integration, file system watcher, and internal event bus.
- 230+ enumerated SecretType constants covering cloud providers, AI/ML platforms, payment processors, CI/CD tools, and performance testing platforms.
- 14 end-to-end tests; full suite passes with Go race detector enabled.
MarketLens
Live web app · React · Python · Market analytics
2026 – Present
A fast, single-page stock analysis dashboard. Search any ticker for a live price, 30+ technical indicators translated into plain-English buy / sell signals, deep fundamentals, options, news, and an aggregated technical verdict — plus a built-in beginner's guide to every indicator.
React · VitePython APIRecharts30+ indicatorsPlain-English signalsFundamentals & filingsOptions chainPrivate login gate
- 25+ analysis panels for any ticker — price chart, indicator signals, aggregated verdict, fundamentals, options, news, correlation matrix, seasonality, insider activity, short interest, and a 10-year SEC-filings deep dive.
- 30+ technical indicators computed server-side and translated into plain-English buy / sell / neutral calls, then rolled up into a single aggregated technical verdict per stock.
- Built-in risk tooling — position sizer, risk/reward calculator, and relative-strength views — so the dashboard supports decisions, not just charts.
- React + Vite + Tailwind frontend and a Python serverless API share one origin on Vercel; a cookie-based login gate keeps the live deployment private.
- An in-app beginner's guide explains every indicator, so the plain-English signals are learnable rather than black boxes.
The live demo sits behind a personal login gate — the gallery above shows the app running on real market data.
2190
Full-stack social platform · Next.js · NestJS · Postgres
2026 – Present
A private, invite-only social network capped at 500 people. Posts vanish after 30 days, direct messages disappear 20 minutes after everyone has read them, and there's no public access — every route returns 404 to outsiders. A full TypeScript monorepo, self-hosted for about $3.50 a month.
Next.js 15React 19NestJSPostgreSQLRedisSocket.ioDrizzle ORMInvite-onlySelf-hosted
- Invite-only by design — no public sign-up; members join by a unique token, the network is hard-capped at 500 people, and every route returns 404 to anyone outside the circle.
- Ephemeral by default — posts auto-expire after 30 days, direct messages vanish 20 minutes after everyone reads them, and a "Vent" mode posts disappear in 24 hours.
- Anti-vanity social design — hidden like counts (only the author sees them), a 10-word comment minimum, Vault posts shared with 1–5 chosen friends, plus subgroups, gatherings, and real-time chat over Socket.io.
- Full TypeScript monorepo — Next.js 15 / React 19 web, NestJS + Fastify API, Drizzle ORM on PostgreSQL 16 + Redis, a WebP image pipeline, self-hosted on a $3.50/month AWS Lightsail Nano behind Cloudflare Tunnel and fail2ban.
Private by design — every route returns 404 to outsiders, so there is no public demo. The gallery above is the running app.
Perflex
Chrome extension · TypeScript · Web performance
2026 – Present
A real-time JavaScript performance profiler for Chrome that tells you which function is making your site slow — and ships a business-safe fix. A free, privacy-first alternative to Lighthouse, the DevTools Performance panel, and commercial RUM, built for attribution depth and actionable remediation. Published on the Chrome Web Store.
Manifest V3Function-level attribution37 anti-pattern detectorsAI remediationCore Web Vitals100% localTypeScript
- Function-level attribution via the Long Animation Frames API — pins main-thread time to a specific script, function, and source location, not just "scripting."
- 37 automatic anti-pattern detectors across loading, execution, rendering, network, third-party, and framework; every finding ships with a before/after code fix, a risk level, and a "won't break your business logic" note.
- Latest release adds an AI Performance Coach (bring your own Claude or Gemini key), a virtualized network waterfall, a local Lighthouse-score predictor with a "what if" simulator, and a third-party impact dashboard.
- 100% local and private — no account, no telemetry; the optional AI feature sends only an anonymized, PII-free summary. Exports to JSON, HAR, OpenTelemetry/OTLP traces, and a printable PDF report.
ArXplained
Live web app · Next.js · AI summarization
2026 – Present
CS research, simplified. ArXplained polls arXiv computer-science papers every hour and distills each one into ten plain-language points with Google Gemini, then presents them on a magazine-grade editorial site with a rolling 10-day window.
Next.js 15React 19Google GeminiNeon Postgrescron-job.orgServer Components · ISRFree-tier · $0TypeScript
- Hourly ingestion pipeline parses arXiv RSS feeds and summarizes each paper into ten layman points with gemini-2.5-flash-lite, storing them in Neon Postgres on a 10-day rolling window with automatic pruning.
- Editorial dark UI (Playfair Display + Inter + JetBrains Mono) with filtering by CS subcategory and full-text search across titles and summaries.
- Built on the Next.js 15 App Router with React 19 Server Components and ISR, deployed on Vercel — the editorial frontend ships as static + ISR pages.
- Every layer runs on a free tier: a cron-job.org scheduler fires hourly into a Vercel serverless function, Google Gemini (gemini-2.5-flash-lite) writes the summaries, Neon Postgres stores them, and Vercel's Hobby tier hosts it all — no credit card, no infrastructure bill, $0 to run.
Vulnary
Live web app · Next.js · Security · AI summarization
2026 – Present
Critical vulnerabilities, explained clearly. Vulnary ingests newly published and newly exploited critical CVEs every hour and answers four questions for each one: what it is, who is affected, how bad it is, and what to do about it. It reads like an editorial publication rather than a SOC console, and turns every confirmed vendor fix into a clear step-by-step procedure.
Next.js 16React 19TypeScriptTailwind v4Neon PostgresDrizzle ORMOpenRoutercron-job.orgFree-tier · $0
- Hourly ingestion pulls from three pluggable sources (NVD 2.0, CISA KEV, and Exploit-DB), enriches with CVSS and known-exploited flags, and upserts by CVE ID so every run is idempotent and resumable.
- Remediation is processed first: each critical CVE becomes plain-English, step-by-step fix guidance grounded strictly in the source advisories, with a visible "verify against the official source" disclaimer on every entry.
- Editorial reading experience with Framer Motion scroll reveals and Lenis smooth scroll, built on the Next.js 16 App Router with React 19 Server Components and deployed on Vercel.
- Runs entirely on free tiers: cron-job.org fires the ingest hourly, OpenRouter writes the structured summaries, and Neon Postgres stores only critical CVEs, purging each one 30 days after an official fix is confirmed.
Nebula Forge
Live web app · WebGPU · Generative graphics
2026 – Present
A single-page WebGPU experience: a real-time market wire (news, FX, crypto, M&A) streamed through an audio-reactive cosmic particle field. Simulation runs entirely on the GPU.
WebGPUWGSL computeAudio-reactivePost-processing graphReal-time market dataMono-first
- GPU-resident particle simulation — every particle's position, velocity, and color is computed in a custom compute kernel each frame.
- Multi-pass post-processing graph: bloom, chromatic aberration, beat-synced glitch passes composited on the GPU.
- Real-time market wire drives the scene — the data feed is the visualization's input signal, not decoration.
- Strict no-off-the-shelf-shaders policy — the entire visual identity lives in a couple hundred lines of hand-written shader code.
Timescape
Live web app · TypeScript · Vite
2026 – Present
The real city, live, with its local time. A full-bleed live street cam paired with an elegant time overlay — real cars, real streets, right now — spanning 34 cities across 21 countries.
Live street cams34 cities · 21 countriesPer-city local timeNo framework~2.4 KB gzippedTypeScript
- Full-bleed live video background with an elegant per-city local-time overlay — no WebGL, no framework, just a hand-built TypeScript app.
- 34 cities across 21 countries, each holding a list of cams that auto-rotate every 3 minutes; a country-grouped menu lets you jump anywhere.
- Production bundle ships at ~2.4 KB gzipped — type-checked and built with Vite.
