~/vitalveev/experiments · 0% ordinary · 100% shipped
i’m Veevaa Bajaj — i ship production protocol infrastructure (indexers, explorers, data APIs) on chains, and i break web apps with permission. 3+ years, 10+ chains, an acknowledged bug-bounty researcher, and everything ends up on a subdomain. I work with my partner Anukul Pandey — here’s a look at the work we’ve built together.
Built and ran indexers, the Reefscan explorer, and data APIs polling in lockstep with the 10-second block time (~8,600 syncs/day, indexed data within ~10s of chain head). Led the EVM migration from Substrate-EVM to PolkaVM — shipped the @reef-chain/evm-util-lib SDK, a Reefswap Uniswap-V2 fork, the Sqwid NFT marketplace, a Blockscout explorer fork, a Rust resolc contract verifier, and node/validator infra. Cut a 3–4 hr release process to ~2 min, and fixed the qix npm supply-chain vuln.
Built the multi-chain wallet & payments layer for a creator-first AI video + NFT platform: WalletConnect + MetaMask SIWE auth, Reown multi-chain support, chain-aware routing, a canonical blockchain server, and a hot-reload Docker dev stack (Colima, Infisical).
Built a cross-platform desktop app with Tauri (Rust) + React + TS for an AI venue product: an AI chat assistant, structured menu CRUD, guest-feedback UX, and crash/performance triage.
Built the Flutter mobile app for a social challenges & payments platform — passkey auth, chat, challenges, notifications, in-app Stripe payments — plus Rust backend services for auth, Stripe webhooks, and transaction APIs.
Authored 50+ merged PRs (docs + sample apps) across 15+ stacks — PHP, Rust, JS/TS, Python, Java, .NET, Go, Elixir, Swift, Kotlin, RN, Next.js, Nginx — covering OpenTelemetry app- and OS-level instrumentation.
Environmental-monitoring instrumentation on the plant floor, plus Kaizen process-improvement proposals.
Replaced paper defect-tracking across 8 assembly zones with a QR-driven web app — zone forms + SMS alerts — plus a paperless records app (Flask, PyMongo).
not just blockchain — an onchain video platform, an AI contract auditor, a freelance SaaS, security tooling, client landing pages. every screenshot captured live: pulled from the running site, or cloned & run locally just for this wall.
founder
No-code tool to turn a CSV into a gas-efficient Merkle-proof airdrop on any EVM chain — deployed straight from your wallet, claimable in one click. App + server + Solidity.
live
Stripe for AI-agent API calls. Wrap any REST endpoint in a pay-per-call gate — agents pay in USDC over the open x402 protocol, on-chain, no API keys, no humans in the loop.
client
A creator-first onchain video platform where every video ships a collectible “Echo.” I built the multi-chain wallet & payments layer — WalletConnect + MetaMask SIWE sign-in, Reown multi-chain, and chain-aware routing across Ethereum, Polygon & Arbitrum.
live
Blockchain explorer + indexers syncing with the 10s block time (~8,600 syncs/day). CoinGecko-compatible supply APIs, cross-chain supply accounting, 4 exchange/on-ramp integrations.
live
Never guess your makeup shade again. Paste any product link — Nykaa, Sephora, Amazon, MAC — and Tryo extracts the true pigment and renders it on your face in real time (468-pt mesh, AI shade-matching).
live
Close the lid — the owl stays up. A tiny pixel owl for your macOS menu bar that keeps downloads downloading, builds building & servers serving with the lid shut. No Electron, ~0.5 MB, no accounts. (he blinks. you can boop him.)
waitlist
A dark mythological action-platformer inspired by Homer’s Odyssey — ten winters of war are ended, and one cursed king must carve a road home through the gods of Olympus. “the war is won. the gods are not finished.”
SaaS
Your entire freelance business in one place — time tracking, invoicing, expenses & tasks, beautifully designed and seamlessly integrated. Full marketing site + app.
client
A booking site for a private eco-farmhouse in Madhya Pradesh — “slow mornings under the teak canopy.” Full landing with gallery, surroundings, tariff and one-tap call / WhatsApp.
4.4k+
Co-founded content brand — your hub for hacking, AI & tech. Bite-sized ethical hacking & cyber-security, plus a blog for the long-form breakdowns. 4,400+ followers across IG, Telegram & more.
grant
ENS-style on-chain naming — registry, ERC-721 base registrar, commit/reveal controller, public resolver + web app. Reef Community Developer Fund grant recipient.
tool
One console line, N WhatsApp messages. A tiny DevTools snippet generator for WhatsApp Web — fill in message, count & delay, copy, paste. Zero install, all client-side.
tooling
Open-source security tools: sqlinjector (SQLi scanner + dork scanner), LFI-Hunter, a dir-buster, a WebRTC deanonymization PoC, and a qix npm supply-chain scanner.
before protocols and pentests, i was soldering sensors and flashing microcontrollers — and taking apart things that weren’t always mine to take apart.
A wearable navigation aid for the visually impaired — sunglasses rigged with ultrasonic sensors that gauge distance to obstacles ahead and to the sides, then warn the wearer through a buzzer and speaker. Built on an Arduino Nano with HC-SR04 sensors and a transistor-driven audio-out.
A little WiFi-driven robot on the ESP8266 / NodeMCU board.
github ↗Flip an LED on and off over WiFi — the classic first IoT build, on the ESP8266.
github ↗Notes & sketches from learning the ESP8266 / NodeMCU board inside out.
github ↗A “learn Arduino with zero prior knowledge” repo I wrote for beginners.
github ↗Self-hosting on a Raspberry Pi 4B — my always-on little box at home.
github ↗
Bringing a decade-old PSP back from a pile of parts, plus teardown tinkering & an Android-hacking crash course — write-ups on my tech odyssey.
read the PSP fix ↗responsible disclosure only. some findings are public, most stay under wraps — here’s what’s on the record.
A resolved GitHub bug bounty ($500), GitHub Thanks & reputation, hunting since 2022. Screenshot straight from the public profile — click through to verify.
Surfaced an access-control gap in organisation internal repositories — an external, non-member collaborator could hold hidden push access that didn’t surface in the members list. Reported via HackerOne, triaged & fixed. GitHub Thanks · reputation 22.
Cross-site scripting on a public surface — reported and acknowledged in Domino’s official responsible-disclosure hall of fame (that’s my name, highlighted).
see the acknowledgment ↗A web-app vulnerability responsibly reported & documented to the institution — patched after disclosure.
OWASP Top 10 the manual way — SQLi, LFI, XSS, broken auth, access-control & logic flaws — with Burp Suite plus my own tooling: sqlinjector, LFI-Hunter, a dir-buster, a WebRTC deanonymization PoC and a qix npm supply-chain scanner.
I break it down in public on Coding Jungle, keep open teardown notes in nice-catch, and file everything responsibly — reports first, writeups later.
Indexers, explorers, EVM/PolkaVM, contract dev & testing, protocol forking, Substrate/Polkadot, Hardhat, wagmi/ethers, MetaMask, IPFS
TypeScript, JavaScript, Python, Rust, Solidity, C++
Node.js, Flask, Docker, Nginx, CI/CD automation, Linux, Bash, Git, OpenTelemetry
PostgreSQL, MongoDB
React, Next.js, Vue, Nuxt, Flutter, Tauri
Web app pentesting, vuln research & responsible disclosure, exploit tooling, OWASP Top 10 (SQLi, LFI, XSS, broken auth), Burp Suite
i build in public. security & code, mostly.
vital is a signal. this is where i keep the receipts — protocols i forked, apps i shipped, bugs i reported. every experiment gets a subdomain and a burst of hyperfocus.
hand-rolled · html · css · vanilla js · no framework · no tracking · just vibes
if something here was useful — or you just want to keep the experiments coming — a few Claude credits go a long way. entirely optional, no strings.
scan on desktop · tap “open in UPI app” on your phone · thank you 🙏