Cybersecurity

An enterprise Zero-Knowledge ephemeral secret-sharing platform designed to eliminate plaintext password and token leakage across help desk operations.

// problem statement

IT technicians and corporate staff frequently share sensitive credentials, database keys, and temporary passwords over unencrypted email, Teams, or WhatsApp messages, creating permanent exposure vectors.

// engineering solution

Architected a zero-knowledge web application using client-side Web Crypto AES-GCM 256-bit encryption. The decryption key is generated in the sender’s browser and stored exclusively in the URL hash fragment (#), ensuring the server never receives the key or plaintext. Built on Upstash Redis with burn-on-view auto-deletion and sliding-window rate limiting.

// key outcome & impact

Guaranteed cryptographic privacy for enterprise IT support operations where even database administrators and hosting servers cannot read transmitted credentials.

Sender Browser (Client-Side Encryption)
  │  1. Generates 256-bit AES-GCM key & IV locally
  │  2. Encrypts secret text ──► Ciphertext payload
  │  3. Assembles link: /view/[id]#[localKey]  (Hash fragment never hits server)
  │
  ├──► POST /api/secret ──► Upstash Redis (Key-Value TTL Store)
  │                          └─ Stores ONLY Ciphertext + Configured Max-Views / TTL
  │
Recipient Browser
  │  1. Retrieves Ciphertext from /view/[id]
  │  2. Extracts #[localKey] from window.location.hash
  │  3. Decrypts secret in-memory ──► Redis atomically burns the key

A browser-based document processing suite with Cinema Mode editing, executing all PDF conversions, metadata sanitization, and restructuring 100% client-side via WebAssembly and PDF.js.

// problem statement

Commercial online PDF tools require uploading confidential contracts, medical records, and financial statements to third-party cloud servers, posing severe data leakage and privacy risks.

// engineering solution

Engineered a zero-upload, client-side PDF manipulation application in Next.js and TypeScript. Leverages WebAssembly and pdf-lib to perform document merging, page extraction, stream compression, damaged xref table repair, and metadata sanitization directly within the browser’s memory sandbox without server uploads.

// key outcome & impact

Delivers complete document editing and privacy sanitization without server transmission, ensuring confidential records remain strictly on the user’s local device.

Browser Client Sandbox (Zero Server Upload)
  │
  ├──► PDF.js & WebAssembly Engine
  │      ├─ Memory-isolated document parsing & rendering
  │      └─ Cinema Mode full-screen reading & annotation
  │
  ├──► In-Memory Manipulation Pipeline (pdf-lib)
  │      ├─ Merge, Split, Reorder, Rotate, Crop (N-Up)
  │      └─ Stream compression & damaged xref table repair
  │
  └──► Security & Privacy Layer
         ├─ Metadata Sanitization (strips author, OS, GPS tags)
         └─ Client-side password encryption & permissions lock

Multi-tenant whistleblower intelligence and employee feedback platform with zero-knowledge submission anonymity, USSD gateway support, and AI sentiment analysis.

// problem statement

Workplace harassment, fraud, and safety violations go unreported due to employee fear of retaliation, while non-desk and frontline staff in low-connectivity areas lack web portals to speak up.

// engineering solution

Architected a multi-tenant feedback platform using Next.js and Supabase RLS. Strips identifying IP headers and client footprints at the gateway. Built a custom USSD session manager and menu builder enabling frontline staff on basic feature phones to submit anonymous feedback and participate in pulse polls without mobile internet.

// key outcome & impact

Created a secure, untraceable reporting channel with automated NLP sentiment prioritization and dual web + USSD accessibility across corporate and industrial teams.

Reporting Channels:
 Web App (Stripped IP / Headers)         Feature Phone (No Internet)
         │                                       │
         ▼                                       ▼
 Next.js Edge Router                     USSD Session Gateway
         │                                       │
         └───────────────┬───────────────────────┘
                         ▼
             Anonymization Pipeline
         (Strips IP, UserAgent, Metadata)
                         │
        ┌────────────────┴────────────────┐
        ▼                                 ▼
 Supabase Multi-Tenant DB       NLP Sentiment Classifier
 (Isolated Org RLS)             (Toxicity & Priority Triage)

An automated security auditing shell suite designed for rapid reconnaissance, port scanning analysis, and system attack surface evaluation.

// problem statement

System administrators need fast, repeatable security checks to identify exposed ports, weak permissions, and outdated network services without relying on heavy proprietary scanners.

// engineering solution

Developed a modular Bash and Python auditing suite integrating Nmap scripting engine (NSE), firewall rule audits, and permission scanners with structured markdown and JSON log output.

// key outcome & impact

Automated repetitive port scanning, service versioning, and attack surface enumeration, replacing manual CLI triage with structured JSON and Markdown audit reports.

Target Network / IP ──► Host & Port Recon ──► NSE Vulnerability Audits ──► Structured Report
 (CIDR Input Range)        (Nmap Engine)          (CVE & Service Probes)       (Markdown & JSON)