I build private AI and self‑hosted software, for people and teams whose data can’t leave the building.

A self-hosted RAG service. You upload documents, ask questions, and get streamed answers that cite the passages they came from. If the documents don’t support an answer, it says so instead of guessing.

• Hybrid retrieval with dense vectors and BM25 fused by reciprocal rank. It abstains when the evidence is weak and audits every citation it emits.
• A golden set of 41 questions with labelled evidence, including multi-hop, cross-language and adversarial cases, scored with Recall@k, nDCG and MRR and bootstrap confidence intervals. Embedding models are chosen by A/B on that set.
• About 300 tests behind an 85% branch-coverage gate, Playwright end-to-end runs, a backup and restore round trip, and multi-arch images with SBOM and provenance.

• Python
• FastAPI
• LangChain
• Qdrant
• Ollama

An end-to-end encrypted messenger for families and small circles. You run a small relay at home; the Android and Mac apps hold the keys.

• Group encryption with MLS (RFC 9420) over Noise, in a Rust core the Flutter apps share through a generated bridge. Local storage is SQLCipher. The Go relay only ever forwards ciphertext.
• A threat model with 13 invariants that the tests check, 13 architecture decision records, and about 620 tests across Rust, Dart and Go. CI runs relay-to-client interop and crash-injection scenarios.
• Not independently audited, and the relay still sees metadata such as who talks to whom and when. The docs say both up front.

• Rust
• Go
• Flutter
• MLS
• SQLCipher

Self-hosted file transfer. Multi-gigabyte files go out through links that expire or run out of downloads, encrypted in the browser so the server never holds the key.

• AES-256-GCM in 4 MiB chunks with order and truncation authenticated. The key travels in the URL fragment and decryption streams through a service worker.
• Up to 10 GiB per file, resumable 32 MiB uploads, streamed ZIP64 downloads and race-safe download limits.
• Moved from Node to a single Go binary built on the standard library alone, with the React UI embedded. 55 rollback checks against the previous image kept existing links and data working.

• Go
• React
• TypeScript
• Web Crypto
• Playwright

One-time secret links. Paste a password or an API key, send the link, and it burns after the first view. The secret is encrypted in the browser, so the server only ever stores ciphertext.

• AES-256-GCM with a 256-bit key from Web Crypto. The key lives in the URL fragment, which browsers never send to the server.
• Burning is crash-safe: the last allowed view writes a tombstone before the payload goes out, so a secret can’t be read more times than it was meant to.
• Ported from Next.js to a single Go binary on the standard library, with rollback tests against the previous image, about 190 HTTP and browser checks, and a graceful drain on shutdown.
• The README is explicit about the limit: encryption in the browser can’t protect you from a server that serves malicious JavaScript.

• Go
• React
• TypeScript
• Web Crypto
• Docker