Full stack developer. Most of my time goes into decompiling programs and figuring out how they work under the hood.
Android APKs, web APIs, infrastructure. If it runs, I've probably opened it up. Some of that got me in trouble. I learned my lesson. Parental controls on all my devices now.
I don't recommend an email provider that isn't Gmail. Gmail has decent spoofing protection to stop people from faking sender addresses — they can still spoof if they get SMTP access, but it's harder. Proton Mail, Apple, Discord, and a lot of others are more vulnerable to spoofing, and some setups can even accept mail that looks like it's to themselves.
So in theory someone could use a proton.me-style address without signing up, use a fake From, and harass a provider or even email the police and get an innocent mailbox tangled up in reports. That wastes everyone's time. Don't do that.
If you're worried about privacy, Tuta Mail is a solid pick — but that alone won't save you. Opsec is habits, not just the inbox. For Tor-only mail, I'd look at Mail2Tor: a Tor hidden-service email provider that runs on the network without a normal clearnet site. Still not magic; you have to use it like you mean it.
VPN tier list
Personal ranking — not sponsored.
S
Mullvad
Top pick. Fast servers, kill switch. No email — you get a randomly generated account number.
B
ProtonVPN
Decent. They claim no logs — I don't buy that. Requires email and phone number.
C
NordVPN
Fast servers, nice UI. Shows up in data breaches too often — wouldn't recommend. Requires email.
D
Windscribe
Slow. Requires email.
D
Surfshark
Slow. Requires email.
Swatting
Swatting is the biggest loser shit.
Ever wondered how big streamers get swatted? This is the dumb playbook people use — so you know what to lock down, not so anyone copies it.
How they try to find you
Anything that leaks location: old posts, databases, usernames tied to real names
OSINT every account they can tie to you — then check breach dumps for emails, passwords, old addresses, phone numbers, anything usable
Search your name online and follow anything still public
IRL streams: read street signs, storefronts, landmarks — then Maps / Earth to guess routes (people don't stand still forever)
What happens on their side (losers)
They want something live so they can watch the reaction. Often it's streamed on a Discord stage while others record and clip. They hide behind VPNs, Tor, and throwaway numbers, then place fake emergency reports — sometimes routing through non-911 lines because 911 isn't always an option from their setup. When police show, chat spams garbage like "LMAOOO" because cruelty is the point.
Why they do it: sometimes they don't even need a stream — they just don't like you, dig through breaches until they have enough to send police to your door, and hope you get hurt. To them it's entertainment. It's not a prank. It's criminal.
Report a swatting
If a swat already happened, send what you have. Paste a link to video evidence (clip, VOD, screen recording). Reports go to me for review — not to police.
Projects
11 builds I still remember.
01 / 11
Web · Norwood, Ontario · 158th fair
Unofficial Norwood Fair website
Redesign of norwoodfair.com for the 158th Norwood Fair. Built to feel like a big exhibition site (think CNE scale), not a small-town flyer.
Unofficial student project. Banner at the top says so. Official tickets and info still live on norwoodfair.com.
Sections slide in on scroll; history years outline then fill in
Scrolling banner of fair highlights
Respects prefers-reduced-motion
Features
Full 3-day schedule with times and locations, day tabs, filters (Horses, Livestock, Music, Family)
Live music lineup with days, times, stages
Ticket prices as ticket stubs
2024 stats: 45,000+ visitors, 23,718 single-day record
History timeline from 1868
Visitor FAQ (parking, accessibility, pets, ATM)
Google map + directions
Get involved: fair book, animals, Fair Ambassador, outdoor stage, volunteering
Contact + fair office details, link to unofficial student TikTok
Stack
React, TypeScript, Vite, Tailwind CSS, Motion, HTML Canvas (gum), SVG (Ferris wheel), Phosphor Icons. Hosted on Cloudflare. Dates, hours, prices, and schedule pulled from the official site and local news; copy lives in one file for easy updates. SEO and social meta included.
Keep your website online, even under attack. guard.snore.pw
SnoreGuard sits in front of your site on a global edge network. It filters attacks from layer 3 to layer 7, hides your origin IP, and balances clean traffic across your servers.
Global CDN & caching
Requests hit the edge closest to the visitor. Uploaded sites and static assets cache at each location, so pages load fast worldwide with nothing extra to configure.
Manage it with AI MCP
Built-in Model Context Protocol server so Claude, ChatGPT, Cursor, and other assistants can add sites, upload hosting, verify DNS, change protection, block visitors, and read stats. Scoped API tokens (read-only or full access), every change audited, revoke anytime.
Network request protection
HTTP request smuggling and malformed requests get rejected at the edge. Clients can't forge IP, origin secret, or internal headers. You can lock a site to specific HTTP methods.
How it works
DNS points at the SnoreGuard edge. Attacks stop there; only clean traffic reaches your origin. Visitors include real users, verified search bots, floods, scanners, and exploit attempts.
Worked on getsolara.dev for a couple months. At the time it was the most popular Roblox executor going.
People started calling it malware. It wasn't. Rumors spread anyway and usage dropped off.
Discord
The Solara Discord vanity URL got banned over and over. When someone still had the vanity on their server, I'd join that server and get permissions in it stupid fast so we could keep a home for users and updates.
Install — cd BellaAI, then pnpm install, then pnpm run setup
Dev — pnpm run dev (Next.js + Convex), or pnpm run dev:next and pnpm run dev:convex in two terminals
Trigger.dev worker — Agent mode needs a third terminal: pnpm dev:trigger. Put tr_dev_… in .env.local as TRIGGER_SECRET_KEY. Add worker env vars in the Trigger.dev dashboard (Convex URL, service role key, OpenRouter, OpenAI, sandbox provider, etc.)
There's also a private family deployment. I don't list the domain here, but you can find that version easily if you look. I don't care — I'm not trying to hide it or lock down endpoints on the sports site.
No ads. Playback starts right away. We run 8+ edge CDNs on the private stack.
Worked on a cheating website for video games — shop, keys, status page, signup, the whole storefront. Provider name is redacted in the screenshots below. I stopped working on it because they weren't keeping their cheats updated.
Database (local dev)
Every page that hit the database took exactly 10 seconds. Not approximate — exactly ten, every time. The database host was unreachable from my PC. A raw TCP probe to the DB port timed out, so each request sat there until the connection attempt gave up. Every page.
Screenshots
Brand name blurred in the captures on purpose.
HeroShopFeaturesUpdates & supportHWIDCleanerSign up
Hosting company I built and ran at fell.pics. It was online for a solid two or three months — not a weekend project, actually shipped and kept running.
Best site design I've done. Still proud of how that front page looked.
Infrastructure
Main box on an OVH dedicated server
Game and bot nodes spread across a bunch of cheap providers — whatever had the best price that week
Worked on thousands of other things too. I can't list all of it — I don't remember it all.
Work
Infrastructure
Canvas
Found the infrastructure path that got Canvas breached.
×2
meemup.com
Flooded stores with orders, fake order descriptions, that kind of thing. Did it twice. Won't do that again. Parental controls on every device I use.
Android RE · Conetic
Instagram font method
Decompiled the Android Instagram app. Font-based auth bypass. Any account without 2FA was vulnerable.
Because of this, if you search Corbin anywhere you'll pull up news articles. The name is easy to find in two seconds if you want it. I'm still keeping it blurred here.
I deleted most of my photos and posts about it. News sites and archives still have the story. Tim Sweeney even weighed in.
Tim Sweeney on X
"Surely 2FA should prevent this."
@TimSweeneyEpic
Meta AI support chat
Screenshot from the flow. Name in the chat is redacted in the image too.
Meta AI · reset password
Video
Original tweet is gone. This is the clip URL from a news embed (Twitter CDN). If it stops working, the articles usually still describe the same demo.
Made it so you could get any username. TikTok's API was public on GitHub the whole time. GitHub is where devs put source code. Someone left it open.
Game cheat · Meccha Chameleon
Meccha Chameleon
First person to make a cheat for Meccha Chameleon. Got sued the next day. Ignored it and sold the cheat's source code for 500 euros in cryptocurrency.
Was staff for Meccha Chameleon after that. Not anymore — I quit.
Skills
Full stack (frontend, backend, APIs, databases)
APK decompilation, static analysis, bytecode
Infrastructure mapping, auth bypass research
JS/TS, Python, Java/Smali, Git
Websites — if I'm offering to make you one, you should accept. Don't miss the chance to have a nice site.
Now
Building
SilentNet RAT blocker
Working on a program to block RAT infections from an upcoming builder called SilentNet. I know how these tools work. Trying to stop them before they spread.
Contact
Email any address below — tell me why you're writing.
