Arshdeep Singh
Full-stack Developer · India
Summary
Solo full-stack developer. I take a project from an empty folder to something live on the internet: the design, the code, the app, the server it runs on. Then I keep it alive. No agency, no team. Most of what I've built is in production right now, used by real people. I write my own crypto, run my own VPS, and ship the whole thing myself.
Skills
LanguagesTypeScript, JavaScript, Python, Kotlin, SQL
FrontendReact, Next.js, Three.js, Tailwind
Backend & dataNode.js, Express, MySQL, Supabase, Firebase, Web Crypto API
InfraLinux / VPS, Vercel, PM2, Cloudflare
Selected work
After Hours2026
A Discord community bot with 98 slash commands: an economy, gambling games, levelling, moderation, and family trees. Every money operation goes through Postgres functions under row locks, so two commands racing each other cannot duplicate currency. It also bridges a Minecraft server both ways through a Paper plugin I wrote, relaying chat, deaths and advancements, drawing a player's inventory as an image, and tracking playtime for a public leaderboard. Node.js and discord.js on Supabase, running 24/7 on my own VPS under PM2. I built the bot, the plugin, and the site that documents it.
CipherDrop2026
Zero-knowledge file and text drops. Everything is encrypted in your browser before it uploads, and the key lives in the link fragment, so the server only ever stores ciphertext it cannot read. AES-GCM through the Web Crypto API, expiring links, burn-after-read, and syntax-highlighted code pastes. It also ships veil, a page that tucks encrypted messages inside ordinary images. I self-host the whole thing on my own VPS.
detsim2026
A standalone deterministic simulation testing library for Go: a virtual-time kernel plus fault-injectable network and storage, the FoundationDB/TigerBeetle style of testing exposed as a reusable tool instead of buried inside one company's database. Proved it out by building an event-driven Raft (snapshotting, linearizable reads, membership changes) and a WAL-based key-value store on top, running thousands of seeded fault scenarios in seconds. Went further with `detsim/rt`, a deterministic green-thread runtime plus a source rewriter that points ordinary goroutine/channel/os/net code at it, so unmodified concurrent Go code gets seed-sweeping, deadlock detection with named goroutines, and delta-debugged failure minimization without being rewritten by hand. Traces are self-describing now (named goroutines, per-decision block reasons) and `detsim-trace` renders them as an annotated timeline plus a keep/drop diff of exactly what the minimizer kept. Caught real bugs along the way in its own determinism guarantee, its fault-injectable storage layer, and the rewriter itself.
Marked Goats2026
An open-source Minecraft mod by Allan Taylor. Gives each of the 8 goat variants its own texture instead of leaving you to guess which horn a goat drops. I jumped in to help rewrite the build system onto Stonecutter, so one codebase now targets Fabric, Forge, and NeoForge across 32 Minecraft versions instead of a branch per version. Along the way I tracked down a few real Minecraft API changes by reading the decompiled source directly, and helped wire up an in-game tooltip that shows the variant on hover. Java and Gradle.
zkaudit2026
A Go CLI that audits whether a "zero-knowledge" or end-to-end-encrypted claim actually holds up, by scanning a real captured HAR (browser network export) for plaintext leaks of a secret you provide, across every request URL, header, and body, including base64-decoded bodies and URL/base64/case-folded variants. Also flags a ciphertext-plausibility signature via base64 density and byte-level Shannon entropy, supports HAR redaction for sharing captures safely, and generates a markdown report plus a pass/fail SVG badge. Ran a real audit against my own CipherDrop upload flow: PASS. Tested against detsim's fault-injecting storage layer too, feeding it corrupted HAR files across thousands of seeds to prove it never panics on malformed input.
mewsync2026
A Go reimplementation of the idea behind mewsic (not a fork): mirrors whatever song you're playing into your Discord custom status, timed to the actual lyric line. Spotify (through Discord's own linked connection), Last.fm (covers YouTube Music via WebScrobbler), and MPRIS for Linux desktop players, all through native D-Bus, no external binary needed. Lyrics come from LrcLib, NetEase, and QQ Music in that order with a disk cache, plus a manual .lrc override. The concurrency core (poller, sender, tick loop) is written against a small runtime interface so the exact code that ships gets exercised by detsim's deterministic scheduler in tests, real goroutines and sync.Mutex in production, same logic either way. That setup caught two real bugs before release: a send-while-holding-the-lock deadlock under a slow Discord API response, and, worse, a build where the engine's goroutines were wired to the test scheduler directly and never actually ran the poller or sender at all, despite compiling clean and serving web requests fine.
replay2026
Records a terminal session to a file the same way script/asciinema do, but playback isn't linear: h/l seeks by 1%, H/L by 10%, g/G jumps to start/end, space toggles auto-play. Its own small VT100 emulator (internal/vt) interprets the recorded bytes into a real 2D cell grid, character plus foreground/background color plus bold, snapshotting every 50 frames so a seek doesn't have to replay from the beginning. Found two real bugs recording an actual fastfetch session in kitty: every byte was being fed to the grid as its own rune with zero UTF-8 decoding, so any non-ASCII character (box-drawing borders, nerd font icons) shredded into 2-4 garbage characters instead of the one real glyph it was; and APC/DCS sequences (how kitty's own terminal graphics protocol embeds a base64 image) weren't recognized at all, so their raw payload leaked into the grid as literal text. Both fixed and covered by tests against the exact captured bytes that found them.
toil2026
A WAL-backed, crash-safe job queue: a server, a client library with a worker pool, a CLI, and a dashboard, deployable on its own. Built as the standalone consumer project for detsim, to answer a real question instead of assuming the answer: does it catch bugs in code that wasn't written with detsim in mind, or only in code written knowing exactly how the harness works? It found a real crash-consistency bug on the second seed of the first real test: FaultyStorage.Sync can silently drop a pending write and still return nil (modeling the exact failure class behind real fsync-lied-about-persisting incidents), but wal.Append advanced its own offset counter unconditionally after every Sync call regardless, so a dropped write left a permanent gap of zero bytes in an otherwise valid log. Fixed by re-deriving the trusted length from what the backend actually confirms durable instead of trusting the offset counter.
zserve2026
A real python -m http.server replacement: static files with content-type guessed from extension, directory listings, and a live dashboard (total requests, bytes served, status breakdown, top 8 paths) redrawn after every request. Zero dependencies, raw Linux syscalls for file I/O and directory reads instead of higher-level stdlib wrappers still shifting across Zig versions. Two real bugs found in testing, documented rather than glossed over: a directory listing parser that read getdents64's null-terminated filename starting at @sizeOf(dirent64), which Zig reports as 24 (padded up to 8-byte alignment) instead of the kernel's actual on-wire 19-byte offset, pulling 5 bytes of padding garbage into every filename; and a path-traversal check that rejected a literal ".." before percent-decoding the URL, so %2e%2e/%2e%2e/etc/passwd sailed straight through since the literal string never appeared until after decoding.
gitpulse2026
Point it at any git repository and get a GitHub-style contribution heatmap, a commit velocity sparkline, a language breakdown weighted by file size, and top contributors ranked by commit count, all rendered live in the terminal. No API keys, no network calls: it shells out to git log and git ls-files and builds the whole dataset from local history and the working tree. Bubbletea and lipgloss for rendering, no git library dependency, no server, no telemetry.
diskgraph2026
Box size is proportional to file/directory size through an actual squarified treemap layout (Bruls/Huizing/van Wijk, the same algorithm class ncdu and WinDirStat use to keep box aspect ratios sane), color cycling by directory depth. Deletion is real: fs::remove_file/fs::remove_dir_all, confirmed once with y/n, no undo, sizes recompute up the tree immediately after. Single-scan-per-launch by design; live filesystem watching and fuzzy path search were scoped out as stretch goals rather than left half-built.
entropy2026
A squarified treemap of a directory tree where box size is file/directory size and box color is Shannon entropy, scaled blue (low, plaintext/structured data) to red (high, encrypted/compressed/packed). Entropy is computed over the first 256KB of each file (full read for smaller ones), sized concurrently with a worker pool bounded by NumCPU. Useful for spotting ransomware activity, verifying a backup is actually encrypted, or finding an accidentally-committed binary blob buried in a repo, with the honest caveat that compressed-but-unencrypted formats (jpg, mp4, zip) read as high entropy too since the tool measures entropy, not encryption specifically.
fracterm2026
Renders the Mandelbrot and Julia sets directly in the terminal using truecolor half-block characters, two vertical pixels per cell, with real-time pan, zoom, and an adjustable iteration cap. Zooming is plain f64 arithmetic, no arbitrary-precision or perturbation-based rendering, so it clamps at the point where a pixel's computed complex-plane coordinate stops resolving as distinct from its neighbors (roughly f64's ~2.2e-16 relative precision) instead of silently rendering a wrong, uniformly-colored frame past that depth.
memlens2026
Attaches to a running process by PID and shows how its heap, stack, mapped libraries, and anonymous mappings grow or shrink over time, right in the terminal. Zig standard library only, no dependencies, polling-based (no ptrace, so it never stops the process it's watching). Polls /proc/<pid>/smaps on an adjustable interval, classifies each mapping, and renders a live table plus a sparkline of heap and stack resident memory over the last 64 samples. Always shows RSS (actual resident memory) alongside virtual size rather than implying they're the same thing, since a mapping can reserve gigabytes of address space while only a few kilobytes are ever touched.
gungnir2026
A terminal emulator written from scratch in Odin, GLFW plus OpenGL, real FreeType and HarfBuzz text rendering, not a stb_truetype shortcut. Full VT100/xterm parsing, the kitty keyboard and graphics protocols (transmit, placement, Unicode-placeholder images, a=q query support), SGR including underline styles and strikethrough, DECSCUSR, shell integration over OSC 8/9/52/133, SGR mouse reporting, resizable splits with mouse-drag dividers, session save/restore, regex-based hint marks, and real ligature shaping through HarfBuzz. Also ships "runes," its own small answer to kitty's kittens: icat for image display, clip for an OSC 52 clipboard bridge, hints as a standalone pipe-friendly picker, and a curated unicode symbol picker. Linux only for now, the pty layer is built directly on POSIX syscalls with no ConPTY equivalent for Windows. Most bugs here got found by actually measuring instead of guessing: a Nerd Font icon crowding bug that looked like a cropping problem but was actually about respecting a font's intentional overflow past its cell advance, a HarfBuzz ligature investigation that turned up contextual-alternate glyph substitution instead of true merged ligatures, and a neovim-quit stall that seemed like a gungnir rendering bug until a real perf profile showed it was nvim's own fsync-on-quit blocking on I/O, nothing to do with the terminal hosting it.
WhatNow2025
A platform for a startup that helps Indian students figure out what to do right after their board exams. I built the site and led the redesign.
LarpRing2026
A webring I started and run: a small ring of personal sites that link to each other the old-web way, so people hop between them instead of trusting an algorithm. I built the site, the hosted theme-aware badges, and an automated health check that pings every member and shows who is up. Invite-only, five sites so far.
A creator community's site that shows every member's live YouTube subscriber count. 17 channels, updated automatically every hour.
What I build
- Websites. Sites that load fast and don't look templatey. I've built landing pages, dashboards, and full web apps.
- Mobile apps. Android apps published to the Play Store. I handle the whole thing (actually) UI, backend, payments, notifications, the boring parts that actually matter.
- Backend, servers & infra. The stuff users never see but always blame when it breaks. Databases, APIs, VPS setup, nginx, PM2, deploy pipelines. This site's status page runs against my actual servers.
- Discord bots & Minecraft mods. After Hours runs 98 slash commands with a money-safe economy. JugaadBridge bridges Minecraft chat to Discord over RCON. On the mod side, I helped rewrite Marked Goats's build system to target 32 Minecraft versions from one codebase.
- Systems programming. Not just web stuff. detsim is a deterministic sim testing library for Go with a source rewriter for goroutine-level determinism. pacfer is a zero-dependency raw-socket sniffer with a live terminal dashboard. Both tested against real bugs, not just assuming they work.
Availability
Open for freelance, contract, or full-time work. Usually replies within a day.