Actively learning
i poke at systems, build what i need, and document what breaks.
i'm tinywifi, a student in Thailand working across security research, computer vision, and small tools that solve sharp problems.4public writeupsfield notes with evidence
4active projectscurrently maintained and live
live signals
- checking live signals
projects with a reason to exist.
maintained tools and archived experiments, each kept here for the problem it tried to solve and the lessons that survived it.
CanvasGLSL
a Fabric mod that replaces Minecraft menu backgrounds with custom GLSL shaders. it includes an in-game IDE, syntax highlighting, Shadertoy-compatible uniforms, live compile, and a file manager.GLSLFabricMinecraft
OpenMU
an unofficial, student-built Mahidol companion that brings Digital ID, classes, timetable, transcript, events, alerts, and campus services into one installable web app.Next.jsAstryxPWA
BTS Tracker
a real-time Bangkok BTS companion with live arrival countdowns, journey planning, fares, station maps, and accessibility details—packaged as a fast installable PWA.TypeScriptBunPWA
helium-syncWindows
PythonGoCLI
grain-clf
YOLOv11PyTorchOpenCV
agri-route
IoToptimization
voice-ai companion
Voice AIThai NLP
notes from the part where assumptions fail.
security findings, computer-vision systems, and the implementation details worth keeping.latest posts
- authorization without a principalan authorized review of a multi-tenant education platform where tenant IDs, unsigned cookies, and unauthenticated service APIs were treated as identity. the result was cross-tenant data exposure, exam-integrity failures, and a potential physical-safety risk.2026-06-108 min read
- corn kernel gradinga technical writeup on building a computer-vision pipeline for grading corn kernels by damage type, size consistency, and quality thresholds.2026-04-294 min read
- red-team observationsa short field note on the same broken trust boundaries that keep showing up in real systems: weak reset flows, bad CORS, exposed admin panels, and callback bugs.2026-04-296 min read
- school management auth bypassunauthenticated account takeover on a platform serving international schools. forgot-password endpoint returns the reset token directly in the http response body — four requests, zero prior access, complete staff admin takeover. bonus: open redirect via unvalidated callbackUrl and potential ssrf vector.2026-04-185 min read
bring a strange bug or a useful idea.
open to collaborations, responsible disclosure conversations, bug-hunting tips, or just a chat.channels
