Megan Witte

Without
Service
API
fakes get in
no verification
With HMAC
Service
Verified
stamp valid
rejected
Message arrivesClaims to be from Stripe
Check timestampToo old? Reject — someone replayed it
Recreate the sealBuild our own stamp, compare safely
Match? Let it throughNo match? Instant rejection

Secure Authentication

ARE Platform · Used by all 9 services

The problem: Anyone can send a fake request pretending to be Stripe or Beehiiv. Without verification, your system trusts imposters.

The solution: Every message gets a cryptographic stamp — like a wax seal on a letter. My code recreates the seal and compares. If it doesn't match, the message is rejected instantly.

Think of it like a bouncer checking wristbands at a concert. No wristband, no entry — and the wristbands can't be copied.
TypeScriptNode.js cryptoExpressHMAC-SHA256
See the actual code
// Check for stamp & timestamp
const sig = req.get('x-signature');
const ts = req.get('x-timestamp');
if (!sig || !ts) return res.status(401);

// Reject if > 5 min old
if (Date.now() - parseInt(ts) > 300000)
  return res.status(401);

// Recreate stamp & compare safely
const expected = crypto
  .createHmac('sha256', secret)
  .update(JSON.stringify(req.body)+ts)
  .digest('hex');
if (!crypto.timingSafeEqual(
  Buffer.from(sig,'hex'),
  Buffer.from(expected,'hex')))
  return res.status(401);

next(); // Allowed through
Without
Beehiiv
SparkLoop
Typefully
data lost
duplicates
With Pipeline
Beehiiv
SparkLoop
Typefully
Database
verified
0 duplicates
Event arrivesBeehiiv, SparkLoop, or Typefully
Verify identityEach source has its own secret key
Archive raw eventComplete audit trail, replayable
Smart deduplicateSame email twice? Update, don't duplicate

Webhook Event Pipeline

ARE Platform · Multi-source ingestion

The problem: Three different services send you customer updates. Without a pipeline, events get lost, duplicated, or arrive out of order.

The solution: One unified intake that verifies every message, archives the raw data for replay, then smartly upserts — so you always have exactly one clean record per customer.

Like a mailroom that stamps every package on arrival, logs it, then files exactly one folder per person — even if three different carriers deliver.
Express.jsSupabasePostgreSQLUpsert
See the actual code
// Verify sender's identity
if (!verifySignature(req, secret))
  return res.status(401);

// Store raw event (audit trail)
await supabase.from('webhook_events')
  .insert({
    source: 'beehiiv',
    event_type: eventType,
    payload: req.body
  });

// Smart update: no duplicates
await supabase.from('subscribers')
  .upsert({
    email, source: 'beehiiv',
    status: 'active'
  }, { onConflict: 'email' });
Without
AI Agent
Computer
blocked
no access
With Bridge
AI Agent
Gate
Sandbox
verified
isolated
AI sends a command"Run this script on the machine"
Verify the tokenWrong password? Instant rejection
Run in sandboxIsolated terminal — can't break anything else
Return resultsCapped output, enforced timeout

Agent Bridge — AI Remote Control

Standalone · AI Infrastructure

The problem: AI can think and write code, but it can't actually run anything on your computer. It's stuck behind a wall.

The solution: A secure API that lets AI execute commands in an isolated sandbox. Authentication + timeout limits + output caps = safe remote control.

Like giving someone a remote control to your TV — but they can only change the channel, not turn up the volume to max or throw it out the window.
Express.jstmuxBearer AuthSandboxing
See the actual code
// Check the VIP pass
if (req.headers.authorization
    !== `Bearer ${TOKEN}`)
  return res.status(401);

// Ensure sandbox exists
try { execSync("tmux has-session -t claude"); }
catch { execSync("tmux new -s claude -d"); }

// Run with timeout, cap output
const timeout = Math.min(120,req.body.timeout);
execSync(`tmux send-keys -t claude "${cmd}" C-m`);
while (Date.now()-start < timeout*1000) {
  out = execSync(`tmux capture-pane -pt claude`);
  if (out.includes(prompt)) break;
  await sleep(200);
}
res.json({output:out.slice(-4000)});

All Projects

ARE Platform

Full-Stack · 9 Packages

Unified business platform: payments, analytics, automation.

Problem: Dozens of disconnected business tools.

One platform connecting Stripe, Supabase, Cloudflare, n8n with shared auth.

TypeScriptSupabaseStripeCloudflare
Click to expand

Command Center

Web App · Auth

Dashboard for managing AI agents with role-based access.

Problem: Multiple AI agents need monitoring with different access levels.

Flask dashboard, JWT auth, role-based permissions.

PythonFlaskJWTRBAC
Click to expand

Code Resolver

AI/ML · Privacy

AI code analysis that never leaves your machine.

Problem: Cloud AI tools require sending code to external servers.

Local ML models (FLAN-T5, Mistral). Zero external API calls.

PythonFLAN-T5Mistral
Click to expand

Auto-Spawn

Automation · v1.4

Auto-launches, monitors, and restarts processes.

Problem: Manually managing background services is error-prone.

Automated spawning with failure detection and version tracking.

PythonShell/Bash
Click to expand

MyMobileIDE

Mobile · Cross-Platform

Real code editor for your phone.

Problem: Mobile code editors are terrible.

React Native app with syntax highlighting and on-device execution.

React NativeExpo
Click to expand

Manifest Proxy

Networking · Dev Tools

Intercepts and transforms network requests.

Problem: Need to inspect traffic without changing code.

Lightweight Node.js proxy for dev workflows.

Node.jsHTTP Proxy
Click to expand

Hulu Proxy

Infrastructure

Captures and debugs encrypted traffic.

Problem: Debugging encrypted service-to-service communication.

nginx + mitmproxy for full TLS/SSL visibility.

nginxmitmproxyTLS
Click to expand

Agent Bridge

REST API · AI

Lets AI safely run commands on your computer.

Problem: AI can think but can't act on your machine.

Authenticated API + isolated tmux sessions. See deep dive above.

Node.jsExpresstmux
Click to expand

Claude Sandbox

REST API · Testing

Safe AI interaction testing environment.

Problem: Testing AI in production risks expensive mistakes.

Sandboxed Flask app with session management and replay.

PythonFlaskAI/LLM
Click to expand

Technical Skills

Languages

PythonTypeScriptJavaScriptSQLShell/BashMATLABC/C++

Frameworks

FastAPIFlaskReact NativeDockerGitGitHub Actionsn8n

Cloud

CloudflareSupabasePostgreSQLEdge FunctionsWorkersnginx

AI & ML

Claude APIOpenAI APIPrompt Eng.RLHFNLPFLAN-T5LLM Eval

Security

HMAC-SHA256JWTRBACRLSOWASPBearer Auth

Data

PandasNumPyTableauAnnotationStats