NJ Email Security Census  DNS survey of every NJ school district, 2026

A passive survey of the email domain of every public school district in New Jersey, all 682 of them. It asks DNS the same questions a mail server asks when a message shows up claiming to be from a district: is there an SPF record, is there a DMARC record, and does it say to reject a fake. 29% publish no DMARC at all, and charter schools are about twice as exposed as regular districts. The dashboard shows aggregates only. No district is named anywhere public, and the per-district findings go to the districts and to NJCCIC first, so a bad grade is a reason to fix a record instead of a headline.

The hard part. Trusting my own numbers. The first run said 28 districts had an SPF include loop. There were zero. My lookup counter used one visited set for the whole walk, so two vendors that both include Google looked like a cycle, and 19 districts got capped at a D for a bug in my code. Fixing it moved 17 grades. Every one of those moves is written down in the changelog, because a grade that changes without an explanation is worse than no grade.

Python, dnspython, SQLite. Cloudflare Worker and D1 for the dashboard, no build step. source

practice.suvir.net  SAT practice, private, 2026

A study app over the 3,714-question official SAT bank, plus a rebuild of Bluebook’s testing surface so practicing feels like the real thing instead of a worksheet. I use it myself. It’s gated and the repo is private, because the questions belong to College Board. The software is mine.

The hard part. A Python extractor. The source PDFs set every equation as vector art rather than text, so nothing parsed straight through. It crops each equation off the page and drops the image back exactly where the math belongs.

Vanilla JavaScript, no build step. Two Cloudflare Workers, D1, Python.

Roon Rich Presence  desktop app, 2026

A local app that publishes what Roon is playing to Discord. No account, no hosted service, and no listening history leaving the machine. Authorization, settings, and diagnostics all stay on your own device.

The hard part. Discord’s SDK is native and proprietary, so it sits behind a small C++ bridge with a stub backend for development and CI, while Roon discovery and playback mapping live in a tested TypeScript core. Every build ships signed, with checksums, an SBOM, and provenance.

TypeScript, React, Electron, C++, Roon API, GitHub Actions. source

Ripuz  Python automation, 2026

On holdI’m rebranding this one and rewriting most of it. What’s below still runs on my server. It just isn’t the version I want to put my name on yet.

A containerized workflow that takes a pile of separate command-line tools with inconsistent output and turns them into one repeatable pipeline: request in, durable job queue, metadata processing, verification, cleanup.

The hard part. Making long jobs safe to resume. Once jobs can overlap or restart, idempotency and deduplication stop being nice ideas, and the preflight checks and disk guards have to run before a big batch instead of after it falls over.

Python, FastAPI, Docker, SQLite.

GuessThatStat  study tool, 2025

An AP Statistics practice app I built for my class. One question, an answer, an immediate explanation, then forward. It started as a way to study and became the first thing I shipped that other people used without me in the room.

The hard part. Not the code, the loop. Classmates found interaction problems in ten minutes that I hadn’t seen in a week of building it alone, and every one of them came down to how fast the feedback showed up.

React, TypeScript, HTML, CSS. source