Independent works

Small Labs — Hue Shift landing pageDesktop view
Phone view

Small Labs

01 / 05 · small-labs.com
Hue Shift · Chrome extension
Problem
People with colour-vision deficiency cannot separate look-alike colours in charts, dashboards, shopping and video.
Built
Hue Shift, a Chrome extension that recolours pages per deficiency type (red-weak, green-weak, blue-weak) so colours that used to look identical can be told apart. Free, no account, no data collection, no remote code.
Ops
Shipped through Chrome Web Store review and maintained in 22 languages. The studio is a Chrome Web Store Established Publisher; its 1Click Auto Refresh and Refresh n Click earned the Featured badge — the store’s bar for compliance, quality, performance and security.
Shows
Browser-extension engineering · Accessibility · Privacy by design · Store compliance
  • 22 languages
  • Established Publisher
  • 2 Featured extensions
  • No data collected
Curlwright request builderDesktop view
Phone view

Curlwright

02 / 05 · curlwright.com
Developer tool · Zero dependencies
Problem
Hand-writing the cURL for an email-sending REST API is error-prone — headers, JSON body, authentication — and pasting a live token into a third-party web tool is a security risk.
Built
A browser-only request builder for Cloudflare Email Sending, SendGrid Mail Send and custom endpoints: compose, validate live, preview the message, copy a runnable cURL. Opens no network connection and never holds a token (connect-src 'none', sandboxed preview).
Ops
20 automated test suites and 109 negative proofs that each safety rule fails when violated; versioned assets; nine security headers verified against the live site; toolchain pinned to an exact version.
Shows
API design literacy · Security by default · Test discipline · Cloudflare Pages operations
  • 109 negative proofs
  • No network calls
  • CSP-hardened
  • Cloudflare Email API · SendGrid
TW Holidays — Taiwan holiday calendar subscription pageDesktop view
Phone view

TW Holidays

03 / 05 · twholidays.com
Calendar service · ICS feeds
Problem
Taiwan’s public holidays are published as government bulletins, not in a form a phone calendar can subscribe to.
Built
A calendar service that turns the official bulletin into subscribable ICS feeds for iPhone, Android, Google Calendar and Outlook, in Traditional Chinese and English.
Ops
Feeds served from a CDN, with download and one-tap subscribe; coverage for the current and next year maintained as bulletins change.
Shows
Data pipeline from an authoritative source · iCalendar standards · Edge delivery · Bilingual UX
  • ICS / iCalendar
  • One-tap subscribe
  • Bilingual
  • CDN-served
Buya Sheep brand home pageDesktop view
Phone view

Buya Sheep

04 / 05 · buyasheep.tw
Self-hosted WordPress → Static
Problem
A self-hosted WordPress site cost more to patch and back up than a small brand could justify, and every plugin was an outside dependency.
Built
A brand-first catalogue site for cross-border sourcing (US, Japan, Hong Kong, Taiwan) that leads visitors from curated products to the order flow.
Ops
Rebuilt from a self-hosted WordPress into a static site on Cloudflare Pages: zero dependencies, zero external requests, self-hosted assets with recorded hashes, and a release gate; still trading since 2019.
Shows
Legacy migration · Zero-dependency delivery · Supply-chain discipline · E-commerce catalogue design
  • Trading since 2019
  • Zero external requests
  • Self-hosted assets
  • Cloudflare Pages
PopMochi sticker brand home pageDesktop view
Phone view

PopMochi

05 / 05 · popmochi.club
Sticker brand · Scripted pipeline
Problem
Turning an original character brand into a shipping digital product requires an asset pipeline and a platform submission process, not artwork alone.
Built
Co-created an original LINE sticker and emoji brand; nine sets published on LINE STORE with the site that markets them.
Ops
Every image is produced by script — die-cut edges baked into the pixels, WebP encoding, share-card generation with pixel-level checks — and the layout is tested across 13 viewport widths behind a 24-check release gate.
Shows
Build automation · Image pipelines · Measurement-driven layout testing · Digital-product launch
  • 9 sets on LINE STORE
  • 13-width layout tests
  • 24-check release gate
  • Share-card generator

Track record

Release gates & supply chain

  • Every release passes an offline gate over the entire shipped artifact — a single failure blocks the release.
  • Every check is verified by deliberately violating its rule — 100+ recorded proofs.
  • No third-party code in shipped products; developer tools pinned to exact versions, adopted after a 30-day cooldown, and audited.

node --test · Python stdlib gates · npm audit signatures · negative proofs

Edge delivery & test rigs

  • Cloudflare edge with versioned assets, so a deployment never serves a mix of old and new files.
  • Security headers and the content-security policy verified byte-for-byte against the live site.
  • Tested in a pinned Chrome, on Windows 11 and the iOS Simulator; print layouts verified in Chrome and WebKit.

Cloudflare Pages · CSP · SHA-256 fingerprints · Puppeteer · WebKit

Payments & billing backends

  • A scalable backend with Stripe subscription billing for a SaaS platform under development — 80%+ coverage enforced, card data handled entirely by Stripe.
  • The in-app-purchase subscription system for a broadcaster’s video platform and its game-show ranking system.
  • User-wallet logic and APIs for a cryptocurrency exchange — deposit addresses swept into a central wallet, real-time transactions.

Stripe · Java · Spring Boot · MongoDB · MySQL · REST · PHP

Platform, data & hardening

  • Cloud infrastructure designed and run on AWS EC2 and Amazon RDS for availability.
  • Relational schema design with SQL query optimisation for production performance, and the data model for a MongoDB service.
  • Cloudflare, Nginx and firewall hardening; private-blockchain integrations (Hyperledger Fabric).

AWS EC2 · Amazon RDS · MySQL · MongoDB · Cloudflare · Nginx · Hyperledger Fabric

Security foundations

  • Tools that hold no secrets: tokens remain in the visitor’s browser and no network connection is opened — 109 recorded proofs.
  • Privacy by design: no data collection, no remote code, no hidden network calls — enforced by tests.
  • In the SaaS under development: no secrets in code, least-privilege roles, personal data handled to GDPR and Taiwan / Hong Kong rules.

CSP · least privilege · no remote code · GDPR · PDPA / PDPO

Applied ML research

  • Hybrid CNN + Transformer model that classifies images and captions together — F1 0.88, above both single-modality models.
  • Federated-learning testbed with a server/client architecture designed from scratch — 99% accuracy.
  • Hyperparameter sweeps, model evaluation and result visualisation as routine practice.

Python · PyTorch · Transformers · sockets · Google Colab

Credentials & stack

Academic credentials

  • Master of Information Technology (Cybersecurity)The University of Sydney
  • Master of Information Technology ManagementThe University of Sydney
  • Bachelor of Engineering (Computer Engineering) (Honours)The Hong Kong University of Science and Technology

Stack

Backend
RESTful APIs · System design · Payment systems · Stripe · Node.js · Java · Spring Boot · Python
Data & cloud
MySQL · MongoDB · Neo4j · AWS (EC2, RDS) · Cloudflare · Linux · Git · CI/CD
Security
Cybersecurity · Content Security Policy · Privacy by design
AI
PyTorch · TensorFlow · Machine learning · Claude Code · MCP · Agentic workflows
Open site