Adwin Chee

Things I have built

  1. Exhibit 01 / 03

    desk-companion

    Plugins run in a sandbox and never hold key material.

    Discipline
    Systems and device
    Built with
    Rust, Slint, JavaScript
    Year
    2026
    Status
    Active
    Desk Companion--:--
    Slot 1free

    No plugin loaded

    Drop a manifest and two files into plugins/ to fill it

    Beacon

    Beat 1284

    every 2s

    EchoStale

    beat 1283

    4 min ago

    Host readoutlive

    0 · 0

    pointer, in a 0×0 viewport

  2. Exhibit 02 / 03

    Zero Trust Architecture

    Keys are derived in the browser, so the server never receives one.

    Discipline
    Web
    Built with
    TypeScript, React, Vue
    Year
    2025
    Vaulta working model · no real cryptography

    1 · Type a passphrase

    Anything at all. It is not stored or sent anywhere. Watch what the browser builds from it, and watch the other column stay empty.

    In this browser

    • Saltnot derived yet
    • PBKDF2not derived yet
    • Derived keynot derived yet
    • RSA-OAEP keypairnot derived yet
    • RSA-PSS keypairnot derived yet

    Sent to the server

    Nothing. Not the passphrase, not a hash of it, not the key.

    Which is also why a forgotten passphrase is unrecoverable here. There is no one else to ask.

    2 · Move the trust score

    Trust is a number, not a yes or no. Every request is scored against a threshold of its own, so the same action flips as this number moves.

    40/ 100

    3 · Attempt something

    Derive the keys first. Type a passphrase above.

    • needs 20 · low riskallowed now
    • needs 40 · medium riskallowed now
    • needs 60 · high riskneeds step-up
    • needs 85 · severe riskneeds step-up
    • no threshold grants this · impossible risknever

    No request attempted yet.

    4 · What the server holds, right now

    • Ciphertext blobs3
    • Saltpublic
    • Encryption public keynone yet
    • Signing public keynone yet
    • Encryption private keynever uploaded
    • Signing private keynever uploaded
    • Derived keynever transmitted
    • Passphrasenever transmitted
    • Plaintext bytes seen0

    Requests it saw

    Nothing yet.

    Every row above is either ciphertext or a public key. Own this server completely and that is still all you get.

  3. Exhibit 03 / 03

    neobank

    A payment request is a claim the recipient settles, not a transfer the sender pushes.

    Discipline
    Web and mobile
    Built with
    TypeScript, React, Express
    Year
    2025
    Requestrecipient's view

    Nadia asks you for

    RM 48.00

    Dinner, Thursday

    Pending your decision

    The request is a claim. Until you settle it, no money has moved and nothing needs reversing; declining costs the sender a decline, not a refund.

More write-ups are on the way.