Demos
Working systems I designed, built, and run. Each one states the problem, who it is for, how it works, and where it stops.
Security Feeds Pipeline
For security teams without a threat-intel budget · Live · auto-updating
A self-updating threat-intelligence page: around twenty sources (CISA KEV, NVD, GitHub Advisories, abuse.ch, malware news, AI-security research) normalised into one view and scored by a deterministic KEV/CVSS/EPSS risk engine. No servers, no database.
Vendor Breach Watch
For GRC and third-party risk owners · Live · public demo + private deployment
A supplier watchlist checked twice a day against public breach and incident sources. A match opens one deduplicated GitHub issue with source links and a remediation checklist, so 'is any vendor of ours in the news?' gets answered automatically.
Password Exposure Checker
For teams explaining credential risk to non-technical staff · Live
Check whether a password has appeared in known breaches without the password, or even its full hash, ever leaving the browser. Built to be shown, not just used: the page explains exactly what is sent and why that is safe.
MCP Threat-Model Template
For teams connecting AI agents to internal tools · Live
A fill-in-the-blanks STRIDE threat model for MCP servers: an interactive 18-question checklist plus a downloadable worksheet, so threat-modelling every new agent integration takes an afternoon instead of starting from a blank page.
Sakinah
For Muslim families in Singapore, on the hardest day · Shipping
Islamic funeral guidance for families in Singapore: the next correct step, offline, and a direct line to an ustaz, a mandi jenazah team, or a provider in one tap. A case study in designing for the user's worst moment, and in reducing risk by deciding what not to build.
Earlier work
- EmpRoster: An easy-scheduling SaaS for teams, built as a school project and evolving into a real product.