I build and maintain web systems, from design through to production.

The system MNT Realty runs on. Prospective clients see the public website. Residents of the stratas MNT manages sign in to the owner portal to read notices, book amenities and download documents. Staff run all of it from the admin console.

Three sites, three subdomains, one build. A proxy routes each subdomain to its own pages — admin to the console, owners to the portal — and the public site answers those same paths with a not-found page. Each keeps its own layout and its own host-only session cookie. Public pages are prerendered; the console and the portal render per request. Every read and write goes through one store interface, so what staff enter reaches residents at once and the store behind it can be swapped for the drafted PostgreSQL schema without touching a screen.

Access is defined once, in a table that the navigation, the page guards and the file route all read. A section outside your role returns not-found rather than forbidden, so the portal never reveals what another role can see. Each strata is a hard boundary: while one is open, nothing from another is reachable. MNT’s own business facts — company details, the strata-document fee schedule, the amenity slot template — are versioned data an administrator edits under Settings rather than values in the source, with every saved version restorable.

All three are built and deployed; cloud data and backend workflows are next. The source belongs to MNT Realty and is not public.

A Flask web app for developers building on FIDO2. Register and sign in with real or virtual authenticators, edit the raw WebAuthn request as JSON, decode what comes back, and look up any authenticator in the FIDO Alliance metadata service. Built during my internship at FEITIAN, and I still maintain it.

Four tabs: simple sign-in, an advanced mode with an editable request, a codec for attestation objects and CBOR/CTAP structures, and a metadata explorer with root-certificate checks. The server is a modified copy of Yubico’s python-fido2 with ML-DSA-44, -65 and -87 added through liboqs. Each visitor gets an isolated session store, on local disk or Google Cloud Storage, cleaned up after 14 days of inactivity.

python-fido2 had no post-quantum support, so I added the COSE identifiers, the key handling and the attestation checks for ML-DSA without disturbing the classical paths. Shipping liboqs in the image made Cloud Run slow to start, which led to a lazy warm-up and a one-worker gunicorn build. The FIDO metadata goes stale, so a daily GitHub Action re-verifies the snapshot and commits it — nobody has to remember.

Live at webauthnlab.tech and maintained under FeitianTech. About 120 server test files, plus frontend and post-quantum tests, run in CI.

A demo for FEITIAN’s customers and sales team. The developer platform is built for engineers; this one is for people evaluating the products. Register a security key, sign in, and watch a post-quantum credential work, without reading a specification.

A React front end over the same authentication service and ML-DSA support as the developer platform, with a guided interface in place of raw requests and responses.

Live at demo.ftsafe.com. The source belongs to FEITIAN and is not public.

A Rust workspace that behaves like a FIDO2 security key, in software. FEITIAN’s engineers and partners needed to develop against ML-DSA credentials before the hardware was ready. It started as my own repository and is now maintained under FeitianTech.

An authenticator core implements CTAP2.1 on the Trussed framework with littlefs2 storage: credential management, PIN/UV protocols 1 and 2, and reset. A runner registers a virtual USB HID device through Linux uhid and speaks CTAPHID, so Chrome, Firefox and libfido2 see an ordinary key. It advertises ES256 and ML-DSA-44, -65 and -87, and ships a small command-line tool (attach, detach, status, reset, pin) that can run as a daemon.

Browsers are strict about what they will talk to, so the HID transport and the CTAP state machine had to be exact before Chrome or Firefox accepted the device. CTAP and COSE structures were designed around classical keys, and post-quantum ones do not fit them neatly. The first version called liboqs over a C FFI; it later moved to the pure-Rust fips204 crate, with secret keys zeroised on drop.

Works on Linux and is used alongside the developer platform. CI runs rustfmt, clippy and the test suite.

My portfolio, at rainzhang.me. One scrolling page in two languages, on its own small design system: one typeface, ivory paper, one accent colour, no borders or shadows. My resume and cover letter use the same system, so the three read as one piece of work.

Next.js App Router prerenders both languages at build time from one typed content model, so /en and /ja stay structurally identical and only the prose differs. Tailwind reads the design system’s tokens rather than raw values, Albert Sans is self-hosted through next/font, and middleware sends a first-time visitor in Japan to the Japanese route unless they have chosen otherwise.

Experience and project rows expand in place, a language switch whose pill slides between English and Japanese, a first-screen entrance in pure CSS, a contact form that posts to Formspree behind a honeypot and a request timeout, and a copy-to-clipboard email. Everything renders without JavaScript and every duration honours prefers-reduced-motion.

Live at rainzhang.me. Unit tests in Vitest and an end-to-end suite in Playwright across Chromium, Firefox, Safari and mobile run in CI.

A CMPT 276 group project. You answer a short questionnaire or pick a place, choose dates, and get hotels, restaurants, attractions and a day-by-day plan, with a chat assistant for follow-up questions.

I built the React and Tailwind front end, the passport and visa questionnaire that asks OpenAI for a destination, the date steps and their validation, and the chat widget. A teammate wrote the Express service that fronts the Tripadvisor API.

The OpenAI key is called from the browser. Today I would put it behind the backend.

Finished in April 2025 and still live.