Ewsirdev

Summary

I am a web developer building landing pages, sites, web apps and backends, most often in Go. The catalogue has 30 projects: 6 landing pages, 4 multi-page sites, 3 web apps, 14 backends and 3 CLI tools; 12 of them run live on Cloudflare. Almost every project is a learning/demo project: the brands are fictional, the data is demo data, and the code is private and shared on request. The exception is one delivered client site (the client is not named).

There are no testimonials or order numbers here. I only show what can be checked: working code, tests and READMEs that list the limitations. Security is checked separately: the approach and a table of closed vulnerability classes are on the Engineering page.

Experience: projects

There are no employers or dates here. Experience is shown through projects: 30 in the catalogue, 12 of them live on Cloudflare. The six strongest:

• Raft KV: a key-value store on Raft
  Raft from scratch: elections, replication, a CRC-checked WAL, HMAC between nodes, snapshots, deterministic failure simulation. 2,646 lines of Go, 27 tests.
• Keyring: an authentication service
  A sign-in provider: JWT EdDSA and JWKS, TOTP, roles, secrets sealed with AES-256-GCM. 2,826 lines of Go, 50 tests, 35 routes.
• Pulse: uptime monitor
  SSRF protection on the real connection against DNS rebinding. 1,445 lines of Go, 18 tests.
• Sluice: API gateway
  A reverse proxy: rate limits, a circuit breaker, protection from open proxy and request smuggling; fuzzing found and closed bugs. 2,334 lines of Go, 48 tests.
• Konvert: notes encrypted in the browser
  One-time notes encrypted in the browser (AES-256-GCM, the key only in the # fragment), Cloudflare Workers + D1, 52 vitest checks. Live demo.
• OKSO T1: 3D landing page
  A WebGL2 landing page: SDF raymarching, GLSL ES 3.00 shaders, scroll choreography. Live demo.

Skills

Languages

Go, TypeScript, Python, JavaScript

Backend

Go net/http, stdlib-first, WebSocket с нуля, Raft, JWT EdDSA, TOTP, RBAC, FastAPI, Node.js (Express, node:sqlite)

Front end

Nuxt 4 / Vue 3, Vue 3 + Vite, Astro 7, Node.js SSG с нуля, HTML, CSS, vanilla JS

Graphics and WebGL

WebGL2 / GLSL, Canvas 2D, SVG

Data

SQLite (WAL), FTS5 / bm25, Cloudflare D1, IndexedDB

Infrastructure

Cloudflare Pages, Cloudflare Workers + D1, Docker, GitHub Actions

Quality and security

go test, go vet, gofmt, fuzzing, govulncheck, gitleaks, vitest, fast-check, pytest, hypothesis, bandit, pip-audit, axe-core, CDP, WebDriver BiDi (puppeteer-core)

Security

• A threat model in every project README: who attacks and what they want.
• An audit of all 13 Go projects and Bad Club; a test was added for every finding.
• Fuzz tests, 20 s per target; bugs found and fixed in api-gateway, notes-search and envguard.
• SAST, dependencies and secrets in CI: govulncheck, gitleaks, bandit, pip-audit, npm audit.
• Secrets only from the environment, private repositories, CSP without unsafe-inline and HSTS in every project.

Limits

• Almost all projects are learning/demo projects; one site is a delivered client site and the client is not named. Testimonials and order figures are not claimed here.
• The race detector (go test -race) is not run on my working machine because there is no C compiler; it runs in CI.
• My own WebSocket layer has not been run against the Autobahn Test Suite: correctness is covered by my own tests. For production, a proven library is the better choice.
• Demo data in the projects (monitoring history, links, jobs) is generated and marked as demo in the interfaces.
• Contacts: Telegram, a GitHub link and e-mail djrciv@gmail.com.