My Work

SFU designed to facilitate real-time multi-party WebRTC video/audio communication and simultaneously provide a dynamically generated, composite HLS live stream for a subset of participants.Manages WebRTC transports for producers and consumers, handling ICE, DTLS, and RTP. A dynamically generated SDP file is fed to an FFmpeg process. This SDP describes the incoming RTP streams (ports, codecs, SSRCs). FFmpeg transcodes these streams, composites the video (e.g., side-by-side layout), mixes audio, and packages the output into HLS (HTTP Live Streaming) format

A lightweight Go-based real-time event notification service, designed as a companion to the main Peeple API. This service utilizes Server-Sent Events (SSE) via an /events endpoint to push updates to connected clients (e.g., an admin dashboard). It features a /trigger endpoint, which, when called (likely by the main Peeple API after a user submits a verification request), broadcasts a notification. The authentication middleware for the trigger endpoint interfaces with the PostgreSQL database to check the user's verification status, preventing redundant notifications. Made because I couldn't get a messaging queue:(

A robust and scalable backend API for 'Peeple', a real-time dating application. This Go-based API powers core functionalities including user authentication (JWT-based, with Google Sign-In option), comprehensive profile management (creation, editing, media uploads, prompts), dynamic user feeds (home feed, quick feed), a real-time WebSocket-based chat system with message reactions and typing indicators (scaled with Redis Pub/Sub), content liking/disliking, matching/unmatching, and an admin panel for user verifications. It integrates with AWS S3 for media uploads (images, audio prompts) via presigned URLs and includes analytics tracking. The application is fully containerized using Docker and deployed via a CI/CD pipeline on GitHub Actions to a Linux VM using Podman and systemd

A feature-rich Next.js 15 starter kit designed for rapid full-stack application development. This project implements a complete authentication system entirely from scratch, including email/password (signup, login, OTP-based email verification, forgot/reset password flows with Argon2 hashing and Pwned Passwords strength checking), and social OAuth (Google with PKCE, GitHub). It features robust session management using HTTP-only cookies and database persistence (PostgreSQL with Drizzle ORM). Additional functionalities include profile picture uploads via UploadThing, server-side rate limiting for API actions, a custom username selection flow post-social login, and a polished UI built with Tailwind CSS and shadcn/ui components. The project is structured with Next.js App Router, utilizes Server Actions for backend logic, and incorporates modern tooling like TypeScript, Biome for linting/formatting, and Turbopack for development. It also serves as a great example of how to build secure and scalable web applications. (Try bunx create-arnav-app for a similar experience!)

A real-time collaborative whiteboard and design application built with Next.js, Liveblocks, and Fabric.js. Users can sign up/log in via email/password or Google/GitHub OAuth. The application features a persistent dashboard for managing design 'rooms'. Within a room, users experience real-time collaboration including live cursors, reactions, shared canvas drawing (rectangles, circles, triangles, lines, freeform, text, image uploads), and threaded commenting. It includes features like OTP-based email verification, password recovery, user profile picture uploads (via UploadThing), and an edit access request system for rooms. The backend logic is handled through Next.js Server Actions, with data persisted in a PostgreSQL database

The design is a hybrid cryptosystem, built on a series of deliberate engineering decisions: Key Exchange: X25519. Chosen over traditional curves (e.g. P-256) for its superior security-by-design. Its Montgomery Ladder algorithm provides inherent constant-time execution, mitigating timing side-channel attacks, while the function itself eliminates the need for complex and error-prone point validation, closing an entire class of implementation vulnerabilities. Authenticated Encryption: AES-256-GCM. An AEAD cipher was chosen to guarantee not only confidentiality but also integrity and authenticity. Each message includes a tamper-evident authentication tag, causing decryption to fail if the ciphertext is modified in transit by an active attacker. Client-Side Hardening: Non-Exportable Keys. To defend against key exfiltration via XSS, private keys are generated as non-exportable CryptoKey objects via the Web Crypto API. This browser-enforced rule prevents JavaScript from accessing the raw key material. The resulting secure handles are persisted in IndexedDB, which is essential to maintain the key's non-exportable guarantee and contains the damage of an XSS attack from a permanent identity compromise to a temporary session hijack.