My Role
Security and full-stack engineer
All Projects
Interactive security buildLatest release case study
Encrypted File Vault
Secure Enterprise Storage
Teams need controlled file sharing that protects content before storage while preserving accountable access and recovery workflows.
Interactive preview
Full demoWhat I Built
Open-source secure file storage prototype with client-side AES encryption, PBKDF2-derived per-user keys, role-based access control, audit logging, S3 presigned URLs, and an admin dashboard.
Evidence
Working interface, documented system behavior, and implementation-level decisions.
Technical Architecture
From system input to explainable output.
The control gate is shown as a first-class stage, not an afterthought added around the workflow.
Technical Decisions
- Implemented role-based access control enforced on the server for every object read and write, since an ownership check in the client is decoration.
- Built an admin dashboard for user, role, and audit review, with destructive actions gated behind an explicit confirmation.
Security Considerations
- Encrypted files client side with AES before upload, so the server and object store only ever hold ciphertext.
- Implemented role-based access control enforced on the server for every object read and write, since an ownership check in the client is decoration.
- Logged every access, permission change, and administrative action to an append-only audit trail with the acting identity attached.
- Built an admin dashboard for user, role, and audit review, with destructive actions gated behind an explicit confirmation.
Outcome & Evidence
- Issued short-lived S3 presigned URLs for transfer so file bytes never pass through the application server.
- Logged every access, permission change, and administrative action to an append-only audit trail with the acting identity attached.
- Built an admin dashboard for user, role, and audit review, with destructive actions gated behind an explicit confirmation.
AES EncryptionS3RBACAudit LoggingSecurity
Working product
Try the interactive demo.
The product experience is part of this case study. Explore it here, reset its state, or switch viewport sizes without leaving the project page.
encrypted-file-vault.zainkhalilkhan.com
Encrypted Vault
Browser native secrets workspace
Encrypted VaultWorkspace6 updates
Cipher VaultAES-256-GCM · ZERO KNOWLEDGE STORE
A working slice of the vault: type a secret, pick a passphrase, and it is encrypted with real client-side AES-256-GCM using a PBKDF2 key (250,000 iterations, SHA-256). RBAC gates decryption per role, and every grant or denial is written to the audit log.
Encrypt a secret
Unlock the vault
Encrypt a secret first, then unlock it here.
Audit log append-only
No events yet
Encryption here is real Web Crypto (SubtleCrypto). Keys are derived and used entirely in your browser and never leave the page or hit a server.
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.
Next Case Study