Across writing, notes, and work.
An open-source OAuth2 and OIDC server: complete enough for a real application, small enough that you can read the authorization endpoint and know what it does. PKCE, refresh rotation, introspection, revocation, pushed authorization requests, passwordless flows, and a full consent UI.
Work
A local-first secrets manager, on the premise that secrets belong next to the repository that uses them. Per-repo vaults, AEAD encryption bound at rest to the device through the TPM, Secure Enclave, or Linux keychain. Export is a portable file, passphrase or public-key encrypted.
Work