zak/lab · rev 3.2.0 · the lab is running
Pick a year. The arm lifts with it. 2022 sits low, on the seam. 2026 is the board up.
The pages are Next.js and TypeScript. Under them: Django, agents, and boards that have to move when the interface says they moved.
Agent coding studio
Invite-only. A planner writes the plan and never touches a file. Workers edit a sandboxed tree under per-agent write scopes, behind gates that fail closed. Previews open on a separate origin, and GitHub gets a pull request, never a merge.
Lecture classroom
A lecture becomes a transcript, a translation, a summary, a diagram, a quiz, and a tutor that answers from that lecture and its syllabus.
Job packet drafter
Scores a posting against a real CV and drafts the packet. It does not click Apply. Below 4 out of 5 it says not to send it. Built on the MIT-licensed career-ops.
Lender desk
The internal desk: underwriting through sanction to maker and checker disbursal. The browser talks to Next. Next talks to Django. A team build; the sanction screens, much of disbursal and the shared proxy are mine.
Loan intake app
Field staff open an application on a phone: applicant, co-applicant, documents, bureau and risk checks, a payment link. Camera, crop and GPS capture, installable as a PWA.
Bookstore
An online Islamic bookshop. Catalog, cart, checkout, reviews, and an inventory desk that is not linked from the shop.
3D cafe website
The menu is a page. The room is a 3D scene you enter through the door. The menu, the reviews, the order link and a coupon hunt sit on the model.
on the floor · hover to look
Before the desk, the work was boards: a radio stylus, a wearable that speaks, and pages served by the microcontroller itself.
Classroom board and stylus
A drawing surface, recorded lessons, and a three-button radio stylus. A pipeline turns each recording into a transcript, 17 translations and a summary. Built with Aishwarya.
Wearable that reads aloud
Five buttons on a Pi, a camera, and a microphone. It reads text, names objects, answers out loud, and flags obstacles. Hardware side of a two-person build with Muhammad Sheikh.
Boards with their own web page
The ESP8266 serves the page. A relay pair for a motor (up, stop, down) and a stepper on an A4988 (clockwise, counter-clockwise, stop).
on the floor · hover to look
Penetration testing, vulnerability assessment, and hardening what I ship: separate origins, HttpOnly sessions, checks that fail closed.
Fix checker
Proposes a fix only after the same detector passes on the patched tree, and re-checks it on a live preview once a person approves. It never merges.
threat register
Every system on this site ships with one. Pick a row to open its dossier.
| id | system | how it holds |
|---|---|---|
| SYS-01 | Whip | Previews run on a separate origin, and the proxy strips cookies and credentials before forwarding. Scope, syntax, compile, test and reviewer gates fail closed. Quotas fail closed at 402. GitHub is PR-only. |
| SYS-02 | EduX Classroom | The tutor’s prompt carries the subject’s syllabus and a grounding rule: a prompt-level guard. Generated visualizers run in a sandboxed iframe under a strict CSP. Token allowances per organisation and per user. |
| SYS-03 | Lumen | OTP codes are HMAC-hashed and compared in constant time. The reset ticket dies when the password changes. A spent allowance returns 402. The model is told not to invent employers, titles, dates, or tools. |
| SEC-04 | WhipGuard | The outcome check fails closed if GitHub, Cloudflare and the dashboard disagree, and Slack when connected. A merged PR counts as a mismatch. Counsel is read-only and cannot approve. Only the worker holds the Docker socket. |
| FIN-05 | Loan origination desk | Read and write are separate permission codes, enforced in Django as well as the UI, so a view-only user cannot post. The applicant’s consent OTP goes over SMS and WhatsApp and is separate from staff login. A cancelled deviation leaves an audit row. |
| FIN-06 | Pravesh | Each co-applicant’s consent is its own OTP, apart from staff login. An expired token comes back as 410, and the client refreshes once and busts the cache. A rule can interrupt a step with a deviation. |
| HW-07 | Smartboard and stylus | Recordings stay on the machine that captured them. Transcripts go to a translation API. The stylus only emits one-character commands. |
| HW-08 | Blind Assist | Nothing runs until a button closes its circuit. The read-outs are spoken on the device. The assistant and its voice are cloud services. |
| HW-09 | ESP8266 web controls | LAN only. The pages have no login, so anyone on the network can press the buttons. Opposite relay directions never energise together. |
| PRD-10 | Spark & Shine | Prices come from the server, not the client. Email OTP covers verification and password reset. The admin API checks staff permission on the server; the page’s path is simply not linked. |
| PRD-11 | LSD Cafe | Collects only an email address per coupon, stored on the server. Nothing is emailed out. The scene is served from the same origin, not a sandbox. |
on the floor · hover to look
A yes means something here is built with it. A no means it is not on this bench.
everything is on the bench
drag to throw · tap a tool to ask the bench
Next.js
TypeScript
C++
Docker
ESP8266
TailwindSaarathi Finance
Founding product engineer, web. Next.js on Django for a lender’s internal desk: underwriting, sanction and disbursal screens, a shared authenticated proxy, and the Pravesh, Connector and Central Access apps. Bulk email and inventory, end to end. 900+ pull requests authored, 270+ reviewed.
The Innovation Story
Robotics and hardware development training.
CoE CNDS, VJTI
Reverse engineering, backend and API security, OS security, IoT and drone security, cryptographic implementation, and device and network reliability analysis.
Outlier
Writing and checking math so a model’s answers get clearer: chain-of-thought reasoning, and correcting hallucinations.
Dataviv Technologies
PCB design and assembly, wireless links over LAN and WLAN, real-time web interfaces, embedded Linux, and getting the system deployed and tuned.
Self employed
Web, security consultancy, hardware repair and assembly, teaching, and product work for small clients.
GDSC VJTI
Started on the cyber security committee, then cyber security lead: workshops on cyber security and ethical hacking. From July 2023, GDSC VJTI lead, organising workshops, guest lectures and events for student developers.
Red Bull India
Campus presence across VJTI, ICT, XIE, and IES.
Xavier Institute of Engineering
Online workshops on web development, security, Python, and robotics.
Awami Jr. College
Information technology for 11th and 12th grade. Exams, notes, and the lab machines.
Sites and web apps. The page, the API behind it, and the deploy.
Installable web apps that live on a phone or in a browser. Camera, GPS, and offline capture where the job needs them.
Circuit, prototype, a web page served by the board, and the link into the software.
Enclosures, mounts, and prototype parts, printed from your model or modelled with you. Made for boards and devices that need a case.
The whole thing: research, the interface, the system under it, and the hardware if the product has any.
Penetration testing, vulnerability assessment, and hardening what I ship: separate origins, HttpOnly sessions, checks that fail closed.
Workshops in web, security, Python, and robotics. Hardware training for students.
Diagnostics, parts, upgrades, and machines that boot again.
Theory without practice is sterile; practice without theory is blind.
A missing page is a small game. Try one →
Each page load adds a record to a log on this server: your IP address and the city, region, country, postal code, approximate coordinates and network it resolves to; where you came from; your browser’s language, time zone and local time; device type; time spent; and the dossiers opened. A third-party location service (ipapi.co) sees your address once to resolve that. Do Not Track is honoured. Add ?notrack=1 to the address to opt out on this browser.
ZAK/LAB firmware 3.2.0
software · hardware · security