Warren S. · github.com/nunchimangchi-dev

Enterprise scale. Real-world systems. Hands-on judgment.

Led workplace technology and delivered enterprise-scale systems and compliance through Atlassian's 9x hypergrowth (1,000 to 9,000+). Now building software in the open to pressure-test architecture, security tradeoffs, and data models directly.

Code is cheap to generate now; technical judgment is not. Challenging enterprise defaults, cutting legacy bloat, and asking whether the software we always bought or built still deserves to exist.

Find me on LinkedIn → · View code on GitHub →

unbrokerrdd

View on GitHub →

Go · SQLite · Claude vision · privacy automation

What it does: Started as a simple attempt to remove my own data from data brokers. Building the tool showed how much effort that takes: sites that block automation, dead or seized domains, and confirmation emails that say nothing about whether anything was removed.

The real decision: The tool deliberately does not defeat CAPTCHAs, so blocked sites are handed to a human and recorded as such.

Current state: It became a documented record of how impractical the process is, in one person's experience. Two of six strategies are built, one is retired on evidence, and the rest are planned. Go, SQLite, Claude vision, real-time dashboard. Built solo.

droppdd

View on GitHub →

Next.js · Prisma · Auth.js · self-hosted

What it does: A live, invite-only beta fitness accountability app (Next.js, Prisma, Auth.js) that I build and operate with full infrastructure ownership: a network-segmented LXC host, a Cloudflare Tunnel with zero inbound port-forwarding, and a separate staging environment. Google OAuth and CI/CD on a self-hosted production deployment.

The real decision: A documented, reversed access-control decision. I added Cloudflare Access in front of the app, then removed it once app-level auth proved sufficient, verified live rather than assumed. Separately, building the wagers feature surfaced a data-scoping bug in tables that had no per-user isolation, caught by checking the real database instead of trusting a clean build.

Current state: Real Google OAuth with an allowlist gate, CI on every PR, production deployment behind the Cloudflare Tunnel with a separate staging environment. A GDPR/CCPA-style data export and deletion flow backs an authored Privacy Policy. Actively developed.

skyrise

chezmoi · fish · tmux · infrastructure

Supporting project. The repeatable dev-environment bootstrap the two projects above are built and deployed on: git/GitHub identity, tmux, fish, Bitwarden, and chezmoi-managed dotfiles, applied identically across a Linux server and a MacBook from one source of truth. chezmoi specifically because it reconciles real Linux/macOS differences from one config rather than maintaining two.

How I work

I scope the approach and the data model, review before code gets written, and verify after: run it, click through it, read the database directly. A green build is not proof it works.

The wagers data-scoping bug on droppdd (above) is why. It only surfaced when the tables were used the way they were meant to be. Code is cheap to produce now. The judgment about what's actually correct, and the calls on data-model and security tradeoffs, are the work.