DEV Community: Akhouri Anmol Kumar

What's Your Favorite Car, and Why? (Mine Is the Lamborghini Urus, and Yes, I'll Defend It)

Akhouri Anmol Kumar — Tue, 13 Oct 2026 12:58:23 +0000

Description: "A car-lover's discussion thread for developers: pick one car, defend it, and tell us the story behind it. Plus a tangent about keys, locks, and the things we protect."
tags: discuss, watercooler, security, python

Let's get one thing out of the way: this is not a "which car has the best 0-100" thread.

Spec sheets are boring. Anyone can paste a Wikipedia table.

What I want is the real answer. The car that makes your chest do something stupid when you hear it start. The one you'd pick if someone handed you exactly one key and said, "This is the only car you'll ever drive again."

So here's the deal. I'll go first, then it's your turn. 🏁

🐂 My pick: the Lamborghini Urus

Yes, the SUV. Yes, that one.

I can already hear the purists typing. "A Lamborghini is supposed to be low, loud, and impractical!" Fair. For decades, that was the whole identity.

But here's why the Urus is my favorite, and it's not the badge.

It's the audacity.

Someone at Lamborghini looked at the brand's entire reputation and said: "What if we built a twin-turbo V8 monster that also fits your family, your luggage, and your groceries, and it still feels like a bull that escaped its pen?"

That's an insane brief. It's like being told:

"Build a tool that's incredibly powerful, but also usable by normal humans, and don't you dare make it feel watered down."

Every developer knows how hard that is. Power and usability usually fight each other. Most products pick a side. The Urus refused to.

And look at what it does with that refusal:

Strada, Sport, Corsa: one car, multiple personalities, switched with a dial.
Terra, Sabbia, Neve: it has modes for dirt, sand, and snow. A Lamborghini. For sand. 😂
Air suspension, torque vectoring, rear-wheel steering. A 2+ ton machine that rotates like something half its size.

It doesn't show off its cleverness. It just quietly rearranges itself so that you feel like a better driver than you are.

That's the exact feeling I chase when I write software. The best systems protect you from yourself while still feeling wild.

The Urus is basically a monolith that somehow scales. 🔥

🔑 The part nobody talks about: the key

Here's a tangent that turned into an obsession.

Think about how a modern car protects itself. It's honestly beautiful:

The key fob isn't just a button. It's a tiny cryptographic handshake.
The immobilizer refuses to let the engine fire unless the right "answer" comes back.
Rolling codes mean that even if someone records your signal, replaying it is useless.

And yet, thieves still beat it. Relay attacks. Signal amplification. Cheap gadgets that cost less than your last tire.

Why? Because the lock was strong, but the assumptions around it were weak.

That sentence has haunted me ever since, because it's exactly the problem with how most of us protect our digital lives. We buy a fantastic lock and then leave the spare key under the doormat: a password reused in five places, a "private" folder named private, a text file called passwords_final_v2.txt.

You know the one. Don't pretend you don't. 😅

🛠️ So I built myself a garage (for files, not cars)

This is where the car obsession and the coding obsession collided.

I got tired of "security" tools that were either:

a shiny UI wrapped around nothing, or
so complicated you needed a degree to lock one PDF.

So I built ATLOCK, a single-(.exe), Windows-first security suite written in pure Python. The newest version, ATLOCK v5, is the one I'm proudest of. And the Urus is honestly the best way I can describe the philosophy: one machine that does everything, without feeling like a compromise.

Think of it like a proper garage:

In the car world	In ATLOCK v5
The ignition key + immobilizer	Your master password, hardened with Argon2id (it makes brute-forcing painfully expensive)
The reinforced steel door	AES-256-GCM chunked encryption, so every chunk of your file is independently authenticated
A second key fob	Optional Keyfile or hardware key (FIDO2 / YubiKey): the file needs your password and the physical thing
The glovebox for sensitive stuff	A built-in password vault, with import from Bitwarden / Chrome / Firefox / KeePass / 1Password
Spare key in a safe place	Shamir secret sharing: split a recovery key into shares so no single person holds the whole thing
The tamper alarm	Self-integrity checks, anti-debug checks, and a canary system that notices when something is poking around

Just like the Urus has its Strada/Sport/Corsa dial, ATLOCK has plain-language helpers like --getting-started and --device-health (it checks things like BitLocker and hibernation settings), so beginners and power users both feel at home. A lock nobody understands is a lock nobody uses.

If you want to poke at it yourself, v5 is here, and you just extract the zip and run the .exe:

👉 Download ATLOCK v5

🧠 The most "car guy" thing I did: I wrote down what it can't do

Every good manufacturer prints the real limits in the manual. (Looking at you, "do not exceed X rpm.")

So at the very top of the ATLOCK source, I wrote an honest security notes section. A few of my favorites:

A same-user attacker who can run code as you can modify a Python script and read its memory. Integrity checks raise the cost; they don't make you invincible.
Python strings are immutable, so wiping a password from RAM is best-effort, not a guarantee.
"Secure shredding" on SSDs can't be promised, because wear-levelling keeps old blocks around. BitLocker is the real fix.
It isn't code-signed and uses no kernel driver. It's an application-layer product, and I say so out loud.

I think that's the most important lesson I took from loving cars: trust comes from honesty about limits, not from a marketing slogan that says "unhackable."

Nothing is unhackable. Anyone who tells you otherwise is selling something.

🏁 Okay, your turn. Seriously.

I told you mine. Now the floor is yours. Drop a comment with:

1. Your favorite car (any era, any country, any budget, even if it's a rusty hatchback)
2. The reason behind it, with the story, not the spec sheet
3. Bonus round: the car you'd never trust with your keys, and why 😄

To get the ball rolling, here are some questions to chew on:

Is your favorite car the one you own, the one you drove once, or the one on your bedroom wall as a kid?
Do you love raw and analog (manual gearbox, no assists), or smart and surgical (the car does half the thinking)?
Hot take: can an SUV ever be a "real" supercar-brand car? Or is the Urus a betrayal? Fight me in the comments. 🥊
Would you trade a faster car for one that's more reliable? Be honest.
Is there a car tied to a person: a dad's old sedan, a friend's first ride, a road trip you never forgot?

And since we're all developers here, one more:

If your favorite car were a piece of software, what would it be?
My Urus is a monolith that somehow scales and still ships features nobody expected. A vintage Beetle? That's a bash script that has somehow run in production for 30 years. A Tesla? Obviously a startup that ships OTA updates every week. 😂

💬 And if you tried ATLOCK v5...

I'd genuinely love your feedback. Tell me what's confusing, what's missing, what you'd want next. I read everything. A tool like this only gets better when people try to break it, question it, and tell me where the lock has a weak spot.

That's how every great car got better, too. One test track at a time.

So: what's your car, and why? 👇

Let's make this the best comment section on dev.to.

I'm 13. I built a 10,000-line security suite for Windows. Meet ATLOCK v5.

Akhouri Anmol Kumar — Mon, 12 Oct 2026 10:03:26 +0000

Description: "ATLOCK v5 by Akhouri Systems: Argon2id + AES-256-GCM encryption, a decoy vault, FIDO2, ransomware canaries, Shamir recovery, and a self-verifying release. Here's how it works."

ATLOCK v5 is out. 🔐

Some people say "Akhouri Systems has never built a serious app."

From today, I have a one-word reply:

ATLOCK_v5

Hey dev.to 👋 I'm Anmol, founder of Akhouri Systems. I'm 13.

I'm not telling you my age for sympathy points. I'm telling you because I want you to judge the app, not the birth certificate. So here it is:

👉 Download ATLOCK v5

What is ATLOCK?

ATLOCK is a Windows-first total security suite, shipped as a .exe and written in pure Python.

Module	What it does
🗄️ File Guard	Encrypt files and whole folders with a password (plus optional keyfile / hardware key)
🔑 Password Vault	Offline vault with a decoy "panic" mode, breach checks, and importers
⚡ Quick Lock	One-click locking from the Explorer right-click menu
🛡️ Defender Dashboard	Security overview, VirusTotal integration, startup watchdog
🐤 Ransomware Canary	Tripwire files that detect suspicious tampering
🧰 CLI toolbox	50+ command-line flags for power users

The app runs exactly as you'd expect with no arguments, and the CLI is there if you want to go deep.

The architecture, in one picture

        ┌────────────── ATLOCK v5 ──────────────┐
        │   Tkinter UI  ·  CLI (--flags)        │
        ├───────────────────────────────────────┤
        │ File Guard │ Vault │ Quick Lock       │
        │ Defender   │ Canary│ Watchdog         │
        ├───────────────────────────────────────┤
        │  2FA: TOTP · FIDO2 · Windows Hello    │
        ├───────────────────────────────────────┤
        │  Sealed State (AES-GCM + HMAC anchors)│
        ├───────────────────────────────────────┤
        │  Crypto core: Argon2id → HKDF →       │
        │  chunked AES-256-GCM (v3.1 container) │
        └───────────────────────────────────────┘

🔬 The nerdy part (my favorite)

1. Container format v3.1: built like a real crypto format

Every locked file, folder, and Quick Lock item uses my own container format:

Chunked AES-256-GCM: each chunk is authenticated independently, so one corrupted chunk doesn't mean a lost file
Key commitment: a wrong password is detected before any plaintext is produced
Per-seal chunk subkeys derived with HKDF
Header-bound AAD: tamper with the header and decryption fails
Padme padding (optional): hides the true file size, with at most ~12% overhead
Backward compatible: v1/v2 containers and old 5.0 files still open and migrate automatically

2. Argon2id everywhere (and a safety ceiling)

Passwords are stretched with Argon2id, at a 64 MB / t=3 floor for files and 128 MB / t=4 for the vault and recovery keys.

The part I'm proud of: untrusted headers can't abuse the KDF. If someone hands you a doctored file claiming "use 40 GB of RAM," ATLOCK refuses. There's a hard ceiling (512 MB, t=6, p=8), so a malicious file can't freeze your PC.

3. The panic password (decoy vault) 🎭

The vault has two passwords:

your real master password
a panic password that opens a believable, entirely fake vault

Here's the clever bit: both slots are derived concurrently with the same KDF cost, so an observer can't tell which password you typed by timing it. And the decoy slot always exists, filled with random bytes if you never set one, so the file itself never reveals whether you use panic mode.

4. Real second factors

TOTP (RFC 6238), implemented in pure Python 🐍
FIDO2 / WebAuthn hardware keys (YubiKey etc.)
Windows Hello (face / fingerprint / PIN)
Fail-closed policy: if your policy requires a second factor and it isn't set up, access is denied, not skipped

5. Anti-rollback sealed state

Settings, vault data, lockout counters, watchdog and canary databases all live in sealed state: AES-256-GCM encrypted, HMAC-authenticated, protected by a Windows DPAPI-wrapped key, and rollback-anchored. If an attacker restores an old copy to reset your wrong-password counter, ATLOCK notices and hard-locks.

6. Breach checks without leaking your password

The vault audits for weak, reused, old, and breached passwords. The breach check uses HIBP k-anonymity: only a 5-character hash prefix ever leaves your machine, never the password.

7. Clipboard that doesn't snitch

Copied passwords are flagged so Windows excludes them from clipboard history and cloud clipboard sync, then cleared automatically.

8. Hardened against nasty files

Folder locking uses a hardened ZIP pipeline that defends against zip-slip, path traversal, symlink tricks, and zip bombs
DLL-planting defence runs before any other import loads a DLL
All data is ACL-restricted to your Windows user
SecureBuffer + VirtualLock + zeroing for secrets in memory, best-effort (see the honesty section)

9. Recovery done right

Shamir secret sharing: split a recovery key into shares and rebuild it from enough of them (--shamir-split / --shamir-join)
One-time recovery codes
Forgot the master password? --reset queues a reset that completes after 24 hours, and any successful unlock cancels it, so an attacker can't instantly take over

10. In v5: stuff I'm really proud of

--getting-started        # plain-language quick start + glossary
--device-health          # BitLocker / hibernation / cloud-folder check
--keyfile-create PATH    # strong keyfile for File Guard
--wipe-free-space        # overwrite free disk space
--fuzz 300               # stress-test the container parser with 300 random corruptions
--pk-keygen / --pk-encrypt / --pk-decrypt / --sign / --check-sig   # public-key crypto
--verify-self            # signed-release self check
--import-passwords FILE  # Bitwarden / Chrome / Firefox / KeePass / 1Password

Yes, ATLOCK ships with its own fuzzer and a self-test (--selftest). I wanted it to attack itself before anyone else does.

Extra lock: in File Guard you can require both your password and a keyfile or hardware key, so a stolen password alone isn't enough.

🧠 Honest limits (the part most projects skip)

Real security engineers respect honesty more than hype, so here's what ATLOCK cannot do. This is also written into the source code:

A same-user attacker who can run code as you can modify the program or its files, or read process memory. Integrity checks and anti-debug raise the cost, but they don't make it impossible.
Python strings are immutable, so passwords can't be guaranteed erased from RAM.
Secure shredding on SSDs isn't guaranteed. BitLocker is the real fix, and --device-health checks for it.
No kernel driver and no code signing. ATLOCK is an application-layer tool, so Windows SmartScreen may show a warning the first time you run it. Check the SHA-256 below before you run it.
FIDO2 here proves the registered key was present and touched. It doesn't validate the vendor.
The real defence against offline guessing is Argon2id + a genuinely strong password.

I'd rather you trust ATLOCK for what it is than be fooled by what it isn't.

🚀 Get started

Download and extract ATLOCK_v5.zip
Run ATLOCK_v5.exe. New here? Try ATLOCK_v5.exe --getting-started first.(when you run ATLOCK_v5 first time it will automatically show the guide)

⭐ Repo: github.com/Akhouri-Anmol-Kumar/ATLOCK

Why I built this

I didn't want to build another to-do app to prove I could code. I wanted to build something where every design decision has a reason, a tool I'd trust with my own files, and one I could defend line by line.

Hype lasts a week, but work that holds up lasts years. That's why ATLOCK has versioned formats, automatic migrations, a self-test, a fuzzer, and a page of honest limitations.

Akhouri Systems is just getting started. ATLOCK v5 is proof of what we can build, and it's the floor of what's coming, not the ceiling.

💬 Your turn, dev.to

Break it. Run ATLOCK_v5.exe --fuzz, read the container format, try to find a flaw.
Open an issue or PR. I read every one.
Tell me what v6 should have. No promises on timing, though. I'm pretty exhausted after this one 😅

I'm 13, I'm just getting started, and this is v5. 😉

— Anmol Kumar Akhouri
Founder, Akhouri Systems

Built with Python, tkinter, cryptography, and argon2-cffi.

I Switched to Brave and Never Looked Back. Change My Mind. 🦁 (Which Browser Do YOU Use, and WHY?)

Akhouri Anmol Kumar — Sat, 10 Oct 2026 08:43:08 +0000

Description: "100M+ people use Brave every month. Is it the best browser for developers, or am I in a cult? Tell me your browser and defend it in the comments."

Let's start with a confession 🙈

I have 40+ tabs open right now.

Docs. Stack Overflow. GitHub. A YouTube video I'll "watch later" (I won't). Three tutorials I opened to "quickly check something" two hours ago. And a localhost project that has been broken since Tuesday.

If my browser were a person, it would be asking for a raise, a vacation, and probably a therapist.

So today I want to ask the question every developer secretly has a very strong opinion about:

🌐 Which browser are you using, and WHY?

Not "which one is popular."
Not "which one came pre-installed."

Which one would you defend at 2 AM in a comment section?

Here's my answer first. Then it's your turn. 👇

📜 A 60-second history of why we're even having this argument

Browsers have been fighting since before some of you were born:

The 90s: Netscape and Internet Explorer go to war. The web becomes a battlefield.
2004: Firefox shows up and reminds everyone that browsers can be good.
2008: Chrome launches, and "fast and simple" becomes the new standard.
2016: Brave appears, co-founded by Brendan Eich, the person who created JavaScript. Yes, the same person. The guy who gave us [] + {} also gave us a privacy-first browser. 😂
2020: Edge switches to Chromium, and suddenly "Microsoft's browser" is a serious option.
Today: Most of the web runs on Chromium, with Firefox and Safari holding the line as the other engines.

Every browser on this list exists because someone looked at the existing options and said, "I can do this better." I love that. It's also why this discussion never ends.

🦁 I use Brave. Here's the honest case.

1. The ad blocker is built in, and for me it's the best I've used

No extension to install. No extension to update. No extension asking permission to "read and change all your data on all websites" (which, let's be honest, should make us all a little nervous).

Brave Shields works from the first launch. It blocks ads and trackers, and it upgrades connections to HTTPS where it can. Pages load faster, the clutter disappears, and I stopped feeling like I was reading the internet through a casino window.

My honest take, not a lab benchmark: after Brave, going back to a browser full of ads feels like going back to dial-up. 😅

You can tune it per site. Click the lion icon in the address bar and you get a dashboard of what was blocked on that page. The first time you see the number on a news site, you will not be okay. 😳

2. It feels lighter on RAM

Every dev knows the moment:

Open a few tabs.
Hear the laptop fan start to sound like a jet engine.
Check the task manager.
Watch your browser casually eating gigabytes like it's a buffet.

On my machine, Brave with an unreasonable number of tabs feels noticeably smoother. Less junk loading (ads, trackers, auto-playing nonsense) means less junk running in the background. Your mileage may vary, so tell me if yours is different. I actually want to know. (More on that in a minute. 👀)

3. The cult following is real 🔥

Brave now has over 100 million monthly active users. That's not a niche browser anymore. That's a movement.

And Brave people are loud about it. Ask one why they use Brave and you'll get a TED Talk. (Guilty. 🙋 I'm literally writing one right now.)

4. It's Chromium under the hood, so my dev life barely changes

Chrome DevTools? Same familiar feel. Chrome Web Store extensions? They work. Switching didn't mean relearning my whole workflow. I got the privacy upgrade without the productivity downgrade.

5. The extras you didn't know you wanted

Built into the browser, no setup:

🕵️ Private windows with Tor for extra anonymity when you need it
🔍 Brave Search, an independent search option
🤖 Leo, a built-in AI assistant
🧰 Fingerprinting protection and cookie controls

Not everyone will use all of it. But having it there is a very different feeling from hunting for five separate extensions.

😬 Okay, but let's be fair: the "Brave isn't perfect" section

I don't trust anyone who says their favorite tool has zero flaws. So here's the honest list:

Crypto and rewards features aren't for everyone. They're optional and you can turn them off, but some people find them distracting.
Past controversies exist. Brave has had a few over the years, and if trust matters to you (it should), read up and decide for yourself.
Shields can break some sites. A login or video player occasionally misbehaves until you lower the shield for that site.
Chromium dominance is a real concern. Whichever Chromium browser we pick, we're all feeding the same engine monoculture. Firefox users have a point here, and I respect it.

I'd rather you hear it from me than think I'm selling you something. Still Brave for me, but with my eyes open. 👀

📊 The Developer Browser Tier List (Fight Me)

Browser	Why devs love it	Why devs rage
Brave 🦁	Built-in blocker, privacy, Chromium DevTools	Some sites get fussy with Shields on
Chrome	DevTools, extensions, everything just works	Hungry for RAM, hungry for data
Firefox	Independent engine, privacy, great CSS tools	Some sites only get tested on Chromium
Edge	Fast, smooth, surprisingly good	"Why is there a shopping tab?"
Safari	Battery life, great on Apple hardware	Testing on it is its own personality test

Disagree with the table? Good. That's literally what the comments are for.

🎭 What your browser says about you (100% scientific, 0% accurate)

🦁 Brave: Reads privacy policies for fun. Has opinions about trackers. Will mention it at parties.
🟡 Chrome: "It just works." Has 87 extensions and no idea what 60 of them do.
🦊 Firefox: Loyal. Principled. Has been defending Firefox since 2009 and is not tired.
🔷 Edge: Quiet confidence. Knows it's good. Tired of being the punchline.
🧭 Safari: Lives in the Apple ecosystem and is happy there. Do not disturb.
🕵️ Tor Browser: You don't tell anyone. You just know.

If I got yours wrong, tell me. If I got it painfully right, tell me that too. 😂

🧪 The Tab Challenge: Let's settle the RAM debate with real data

I don't want you to just take my word for it. Let's test it. Takes 3 minutes:

Close everything except your browser.
Open the same 10 tabs in each browser you use (same sites, same order).
Wait about a minute for everything to settle.
Open your Task Manager (Windows) or Activity Monitor (Mac) and check the browser's total memory.
Come back and post your result in the comments.

Use this format so we can compare:

Browser: ___ | OS: ___ | Same 10 tabs: ___ GB

If enough people join, I'll collect the results in a follow-up post. Real numbers from real dev machines, no marketing. 📊

(And if Brave loses on your machine, I want to see that too. Honesty gets more respect than fanboying.)

🛠️ 5 DevTools tricks I wish I'd known years earlier

Since this is dev.to, here's some actual value. These work in any Chromium-based browser, Brave included. Save this post. 😉

1. The command menu. Open DevTools, then press Ctrl + Shift + P (Cmd + Shift + P on Mac). You can type almost anything: "screenshot", "dark theme", "disable cache". It's like a search bar for DevTools.

2. Full-page screenshots without an extension. In that same command menu, type screenshot and pick Capture full size screenshot. Boom, the whole page.

3. $0 in the console. Select an element in the Elements panel, then type $0 in the console. You now have a live reference to it.

4. console.table() for readable data. Stop squinting at nested JSON:

console.table([
  { browser: "Brave", ram: "happy" },
  { browser: "Other", ram: "crying" }
]);

5. Network throttling. Open the Network tab and set throttling to "Slow 4G". Suddenly you can feel what your users on bad connections feel. It's humbling. 🥲

Got a better trick? Drop it in the comments. The best ones go in my notes, and I'll credit you.

🧠 Plot twist: building for the browser changed how I see browsers

Once I started building tools for the browser, I stopped seeing it as a window to the internet.

It's a runtime now.

I build under Akhouri Systems, and one of my projects is APIC (Advanced Image Processing Center). It began as a desktop app in Python and PyQt6 with Edit, Convert, Compress, Search and batch processing. Then I had a question that wouldn't leave me alone:

Could this live entirely inside a browser tab?

It could. Today the web version does all of this inside the tab, with no server round trip for your images:

🎨 Edit with filters like Cyberpunk, Sepia, Noir and Cold Chrome, plus levels, gamma, sharpen, temperature and vignette
🔄 Convert between PNG, JPEG, WebP, BMP, ICO and PDF
📉 Compress to a target file size by searching for the best quality that still fits
✂️ Remove backgrounds with on-device AI
🪄 Remove objects using an inpainting model (MI-GAN) running through WebAssembly
📐 Resize with step-down resampling, so results stay crisp instead of muddy

Your image never leaves your device. A browser that respects your privacy plus a tool that respects your privacy turns out to be a really good combination, and that's a big reason I care about this whole topic.

👉 Try it here: APIC Web

Honestly, the weirdest part of this project was realizing how much a modern browser can do without a backend: canvas, WebAssembly, on-device ML models, file downloads. Ten years ago this would have needed a server farm. Now it's a tab. That alone makes me excited to be a dev in 2026.

It also changed how I test. Every feature I built had to be checked in multiple browsers, because "works in my browser" is the most dangerous sentence in web development. Brave with Shields on is actually a great stress test: if your app survives an aggressive blocker, it's more robust for everyone.

And if you're the "I want it on my desk, offline" type, there's a desktop build too:

👉 APIC for Windows (.zip, no account needed)

If something breaks, tell me in the comments. I read every single one. 🙏

🔄 Thinking of switching? Here's how to do it without pain

If this post made you curious, here's the easy way:

Install the new browser and keep your old one for a week. No pressure.
Import your bookmarks and passwords. Most browsers have a one-click import.
Sign back into your extensions and see which ones you actually need. (You'll be surprised how many you don't.)
Use it for real work for 7 days. Not just casual browsing, your actual daily workflow.
Compare. Speed, battery, RAM, how you feel.

If you hate it, switch back. Zero shame. The best browser is the one that makes you more productive.

⚡ Lightning Round: answer in one word

Reply to this post with just one word for each:

Best browser for developers?
Best browser for privacy?
Best browser for battery life?
Most overrated browser?
Browser you secretly use but won't admit? 🤫

Short answers, long arguments. Let's go.

🔥 Unpopular opinions corner

I'll start with mine. Come argue:

"Most people don't need 20 extensions. They need a better browser."
"If your site breaks with an ad blocker on, that's a design problem, not a user problem."
"Tab hoarding is a personality, not a bug."

Now post your unpopular browser opinion below. The spicier the better, and I promise to reply with respect even if I disagree. 🤝

🎤 Now it's YOUR turn

Drop your answers below. I want the real ones, not the polite ones:

🌐 What's your main browser, and what's the ONE reason you'd never switch?
💀 What's the browser feature you'd fight to keep?
😤 What's the dumbest thing your browser has ever done to you?
🔥 Hot take: which browser is overrated?
🧩 What's the one extension you can't live without?

🗳️ Vote with an emoji in the comments:

🦁 = Brave
🟡 = Chrome
🦊 = Firefox
🔷 = Edge
🧭 = Safari
🎭 = "Other, let me explain..."

I'll count the votes and post the official dev.to browser results in a follow-up. 📊

🏆 The Comment Challenge

Copy this and fill it in. It takes 10 seconds:

My browser: ___
Why I'll never switch: ___
My hottest browser take: ___
Tabs open right now: ___

I'm going first: Brave / the built-in blocker / "RAM usage is a feature" / 43. 😅

Beat my tab count and you win. Nothing, except pride and my eternal respect.

💎 If this made you laugh, nod, or want to argue

Hit the ❤️, drop a 🦄, and tell me why my browser is wrong. The best comment gets a detailed reply from me, and the funniest one gets a follow.

See you in the comments. Bring your hot takes. 🔥

Which browser are you using, and WHY? 👇

P.S. If you read this far with 30 tabs open, you're my kind of person. Please close at least 10 of them. I won't. 😄

P.P.S. Found a bug in APIC, or have a feature idea? Put it in the comments. Half of the best features in any project come from people who weren't afraid to say "hey, what if...?" 💡

I'm 13 and I Built a Security Suite. So... Does Age Really Matter?

Akhouri Anmol Kumar — Fri, 09 Oct 2026 11:23:00 +0000

TL;DR: I'm 13. I built ATLOCK v5, a full security suite in Python. Nobody asked my age when I typed pip install, and the compiler never asked either. So let's talk about whether age really matters. 👇

The question nobody asks out loud

Every time someone finds out I'm 13, the conversation changes.

Before they know: "Interesting project. How does the encryption work?"
After they know: "Wow, that's so cute! Did your dad help?" 🙃(and for akhouri systems my dad is the biggest enemy)

Same code. Same project. Different reaction. The only thing that changed was a number.

So I want to ask this honestly, and I want you to answer honestly:

Does age really matter?

Quick intro (I'll keep it short, I promise)

I'm Anmol, I'm 13, and I run Akhouri Systems, a tiny one-person software company where I build things that probably shouldn't be built by someone who still has homework.(😂☠️🔥)

My biggest project is ATLOCK, a security suite written in Python. Version 5 is now 9,000+ lines of code(it was peaked 10870+ lines but somehow I removed the useless stuffs), and here's what's inside:

🔐 AES-256-GCM encrypted containers with key commitment
🧠 Argon2id password hashing, so brute-forcing hurts
🗝️ A password vault with 2FA (TOTP) support
🎭 A panic password that opens a decoy vault instead of your real one
⏳ Smart lockouts with exponential backoff that resist clock tampering
🧩 Shamir secret sharing to split recovery keys
🛡️ Optional TPM-backed key protection and Windows Hello support
🔎 Breach checks that never send your password anywhere (k-anonymity)
🧪 A built-in fuzz self-test, because I break my own code before you do

I'll say the bold part out loud: I believe ATLOCK v5 is one of the greatest Python security suites ever built. 😤 on planet earth 🌎

Bold? Absolutely. So don't take my word for it. Try to break it. More on that below.

"But you're 13." Okay. Let's test that.

🧍 What people assume at 13	🔧 What actually happened
"You copied it from a tutorial."	There's no tutorial for a decoy-vault, lockout-rollback, Shamir-split recovery suite. I read docs, broke things, and rebuilt them.
"You can't understand cryptography."	I don't need to invent crypto. I need to use it correctly, and that's a skill, not an age.
"It must be buggy."	It was buggy. I found and fixed rollback, timing, and lockout bugs. Every codebase has bugs. Age just gets blamed for mine.
"It's a school project."	School doesn't assign this. Curiosity does.

Okay, but let's be honest: where age DOES matter

I don't want to write a "kids are geniuses" post. That's lazy, and it's not true. Here's what age genuinely changes:

Experience. I haven't seen a production system fail at 3 a.m. Older engineers have, and that scar tissue is real.
Formal credentials. No certifications, no independent security audit. ATLOCK has not been audited by a third party yet. If that matters to you (and for security software it should), I get it.
Time. I build between school, exams and life. Progress is slower, not smaller.
Trust. People trust a name with a decade behind it faster than a name that's 13. Fair enough. Trust is earned.

But look at that list again. Every item is about experience, evidence and time, not about the number itself.

Age isn't the thing that matters. It's the thing people use because it's easier than checking the work.

A 40-year-old on day one of Python writes the same NameError I did. A 13-year-old who's shipped for years has seen things. The calendar is a bad proxy for skill. It's just an easy one.

The part I need to say to the other side too

Being young is not a free pass.

Please don't clap for ATLOCK because I'm 13. That would be the exact opposite of what I'm arguing. It's security software. If it's wrong, people lose data. So judge it the way you'd judge anything:

Break the App(for now break v4 which is easy to break maybe 😂 but if you want to break harder ones then wait for ATLOCK v5)
Open an issue. Tell me what's weak.
If I'm wrong, say it. Politely or not, I'll read it either way.

Respect the work, not the age. Criticize the work, not the age. That's the whole deal.

Try ATLOCK (the old one) right now

ATLOCK v5 is releasing on 12 October. 🚀
Until then, you can try the previous version:

Akhouri-Anmol-Kumar / ATLOCK

Free Windows security suite — System Lockdown, File Guard, Password Vault.

The Total Security Suite for Windows. One .exe. Zero installers. Zero compromises.

Direct download · no sign-up · no ads

Features · Installation · FAQ · Roadmap

🧭 What is ATLOCK?

"We build what others forgot to fix." — Akhouri Systems

ATLOCK is a Total Security Suite for Windows — built by one developer who got tired of half-baked "lock apps" that promise security and deliver a password prompt.

📦 Single portable .exe
🚫 No installation, no setup wizard
▶️ Download → Run → Done

📋 Table of Contents

⚠️ Windows Defender Warning — This Is a False Positive

Windows may flag ATLOCK as an "unrecognized app" or suspicious. This is a well-known false positive for unsigned, PyInstaller-built Python applications — it is not malware.

🛠️ How to run it anyway…

View on GitHub

⬇️ Direct download (v4): https://fn6qtj.s.gy/ATLOCK-v4
🐙 GitHub: https://github.com/Akhouri-Anmol-Kumar/ATLOCK
🌐 Akhouri Systems: https://akhouri-anmol-kumar.github.io/Akhouri-systems/

v4 is the warm-up. v5 is the real thing.

Now it's your turn 👇

I genuinely want to hear this, so pick any (or all) of these and fight me in the comments:

When did age help or hurt you in tech: a job, a project, a conversation?
If you saw this exact project from an anonymous account, would you have reacted differently? Be honest. 😅
Is there an age where "too young" or "too old" is actually true? Where's the line?
Security people: what's the first thing you'd attack in a Python encryption suite?

I'll be in the comments replying to everyone. Go ahead, tell me I'm wrong. 😄

Built by a 13-year-old who still has homework due tomorrow(Lol half-yearly examinations are happening in my school). If you read this far, thank you, and see you on 12 October. 🔐

1,000 downloads. I'm 13. I made you a promise. 🔓

Akhouri Anmol Kumar — Thu, 08 Oct 2026 04:16:40 +0000

A few weeks ago I wrote this on dev.to:

"ATLOCK v5 ships when Akhouri Systems crosses 1,000 downloads."

At the time we were at 959. Then 967. I kept refreshing like a maniac. 😅

Today I can say it:

1,000 downloads. In 5 months. Thank you. 🫵

🙏 First, the thank-you

I'm Anmol, I'm 13, and I build free Windows software alone, on an HP 240 G9, usually at 12 AM.

Every download is a person who trusted a kid's .exe on their own PC. Every comment, bug report, and roast made the code better. Here's what you did for me:

You downloaded ATLOCK, ANOTE, ACALCU, and APIC.
You told me what was broken. I once posted "I have 511 users and almost zero feedback," and you answered.
You read my code and found problems I'd missed, and I fixed them.

Nobody handed me an audience. You built it, one download at a time.

🔐 So... ATLOCK v5

v4 was the version where I stopped trusting my own encryption and rebuilt it. v5 is the version where I rebuilt almost everything underneath. Here's what's in the development build:

🧱 A new crypto core

AES-256-GCM encryption
Argon2id password-based key derivation (memory-hard, so brute-forcing is expensive)
HKDF domain separation, plus stricter KDF limits so a malicious file can't burn your CPU or RAM
Optional TPM-backed Windows CNG key support
A controlled Vault Recovery Key system

🔑 Real second factors

TOTP and FIDO2 / YubiKey-class hardware keys
Panic / decoy vault concept

🛡️ Security Guard

Windows Defender dashboard integration
VirusTotal hash lookup
Startup-persistence watchdog
A ransomware "canary" concept that watches decoy files

🧰 Under the hood

Anti-tamper and rollback protection, plus debugger checks
Locked and zeroed memory buffers for key material
Automatic migration from older ATLOCK formats, so nothing you protected in v1–v4 gets left behind
A real CLI (--selftest, --shred, --vault-audit, and more)
Quick Lock, a Windows Explorer integration so you don't have to open the app to lock a file

All of this comes from the current development build. Features can still change before release, and I'll tell you honestly what ships.

🐛 The part nobody posts about: I audited myself

While building v5 I hunted bugs in my own tool, and I found six that looked fine until they weren't, including:

an infinite loop in chunked AEAD
a 2FA lockout
a file shredder that wrote one byte 😬

I also pasted 8,500 lines into an AI for review. It confidently reported a bug that didn't exist, and grep proved it. My lesson: demand line numbers, and verify everything.

Security software isn't trustworthy because the author says so. It's trustworthy because people break it and the author fixes it in public. That's why I want you to try to break v5.

📦 What happens next

✅ Milestone hit: 1,000 downloads
🔨 v5: final testing and cleanup
📣 Release: [It is not fixed but high chances are that ATLOCK v5 is set to be released publicly in 12october, 2026]
🟢 ATLOCK v4 is still available and free if you want to start now

Download v4 here: https://fn6qtj.s.gy/ATLOCK-v4

🫵 Your mission (yes, you)

Try v4 and tell me what feels slow, confusing, or breakable.
Open an issue or leave a comment with your roast. I read every one.
Tell me: which v5 feature do you want to test first?

Unsigned apps may get a SmartScreen warning. That's a known false positive for indie PyInstaller builds.

🔗 Find me

🌐 Website: https://akhouri-anmol-kumar.github.io/Akhouri-systems/
💻 GitHub: https://github.com/Akhouri-Anmol-Kumar
💼 LinkedIn: https://www.linkedin.com/in/akhourianmolkumar/

1,000 was never the goal. It was the unlock. 🔓

Thank you. v5 is next. ⚡

— Anmol, Akhouri Systems

Your GitHub README Isn't a Profile. It's a Storefront. (Here Are the 5 Rules I Used

Akhouri Anmol Kumar — Tue, 06 Oct 2026 10:25:07 +0000

Description: "I stopped decorating my GitHub profile and started shipping it like a product page. Four apps, four download buttons, zero widgets."

I [stopped / spent a weekend] treating my GitHub profile like a résumé and started treating it like a product page.

Now a stranger lands on it and can download one of my four apps before they finish reading my name.

👉 Live: github.com/Akhouri-Anmol-Kumar

Credit: the spark to push my profile past badges came from Giorgi Kobaidze's cyberpunk-console post. Go read it.

The problem with every "awesome" profile

Open ten popular profile READMEs. You'll see the same things:

a wall of badges
a stats card that shows commit counts
a "Hi 👋 I'm ___" line
a snake eating your contribution graph

They're decorations. None of them answer the question every visitor has in the first three seconds:

"What can I get from this person, right now?"

I build desktop apps: ATLOCK, APIC, ANOTE and ACALCU. So I asked myself a different question:

What if my README worked like an app store listing?

The 5 Rules of a Storefront README

Rule 1: The 3-Second Download Test

If someone can't download your best work within 3 seconds of landing, the page has failed.

So each of my apps gets its own card, and directly under every card is a download button that points to the actual .zip release. There's no "see releases" and no hunting.

<td align="center">
  <a href="https://github.com/USER/APP">
    <img src="assets/app_card.svg" width="408" alt="APP">
  </a><br>
  <a href="https://github.com/USER/APP/releases/download/TAG/APP.zip">
    <img src="https://img.shields.io/badge/⬇%20DOWNLOAD%20APP-B8935F?style=for-the-badge&labelColor=8a6c3f&logo=windows&logoColor=white" height="38">
  </a>
</td>

Card on top, action underneath. It's the same pattern as a store listing.

Rule 2: Pick one metal and never leave it

Mine is gold: #B8935F for the light tone and #8a6c3f for the shadow.

The ring-light logo, the section headers, the buttons and the card edges all use it. Because every element shares one palette, the page looks designed rather than assembled.

Badges look cheap because they're every color at once.

Rule 3: One width, everywhere

Every full-width image on my profile is 830px. That's the entire layout system.

Nothing is slightly wider or narrower than its neighbour, so the page reads as one column instead of a pile of widgets. The app cards are 408px, which is two cards plus a gutter inside that same 830.

If you only copy one rule from this post, copy this one.

Rule 4: Name your sections like paths

My headers aren't "About Me" and "Projects". They are:

~/links
~/apps
~/status
~/stack

It costs nothing, and it tells a developer in half a second that the person behind the page lives in a terminal. It also makes the page scannable, because every header looks the same and sits in the same place.

Rule 5: Make your manifesto a design element, not a paragraph

Right in the middle of the page I put one banner:

Zero telemetry. Zero cloud. Zero subscriptions. Zero ads.

It isn't a bio line. It's the whole product philosophy, rendered as a full-width image. And the page closes with one sentence:

Your machine. Your data. Your control.

Visitors don't remember bullet lists. They remember a line they could repeat.

The "no widgets" decision

I made one hard choice: every visual on my page lives in my own repo.

No stat cards from someone else's server. No streak counters that go blank when a free service sleeps. No images that vanish when a third party changes a URL.

My cards, headers, hero and footer are all SVGs in /assets, and the only outside piece is the download badge. (If I ever need to remove even that, I can swap in my own SVG.)

Two details that matter:

I use absolute raw.githubusercontent.com URLs for images, so the README still renders if it's copied, mirrored or previewed somewhere else.
Everything has alt text, including the manifesto banner, so the page works for screen readers and for people whose images fail to load.

The structure at a glance

[ ring-light logo ]
[ hero: whoami ]
[ ~/links  → Website · Blog · LinkedIn · Peerlist · Instagram ]
[ ~/apps   → 2×2 grid of cards, each with a DOWNLOAD button ]
[ ~/status → ZERO telemetry banner ]
[ ~/stack  → tech stack ]
[ footer   → "Your machine. Your data. Your control." ]

Only six sections and one action per app. Nothing on the page is there just to fill space.

Here's the challenge. Your profile has one job. Find it, then make that job a button.

Selling apps? Put a download button under each one.
A writer? Put your three best posts as cards.
A library author? Put npm i your-lib as the hero.

Then drop your link in the comments and tell me the one action your page is built around. I'll read every one.

Stop decorating your profile and start shipping it. 🚀

I'm Anmol, and I build privacy-first desktop software at Akhouri Systems.
🌐 Website · 💼 LinkedIn · 🔒 ATLOCK

💀 I Hunted Down the Silent Killers in ATLOCK v5 (And Why Your Python App is Probably Failing in Silence) 🔥

Akhouri Anmol Kumar — Mon, 05 Oct 2026 08:52:21 +0000

💀 I Hunted Down the Silent Killers in ATLOCK v5 (And Why Your Python App is Probably Failing in Silence) 🔥

"The devil isn't in the missing comma. The devil is in the background thread that silently fails to lock the vault when Windows goes to sleep."

We are at 984 downloads across all Akhouri Systems products. Just 16 more until we hit the 1,000 milestone.

ATLOCK v5 is 100% built, battle-tested, and ready to ship. But before we drop the hammer and release it to the wild, I need to talk about the monsters I had to slay in the codebase.

This isn’t a post about "I fixed a missing comma" or "I updated a dependency." This is a deep dive into the architecture-shattering, silent-failure bugs that keep security developers awake at night.

If you build security tools in Python, you need to read this.

🧵 1. The Tkinter Thread-Safety Illusion

The Nightmare: Background workers (Vault health checks, Defender status updates, Watchdog scans) were directly calling self.after(0, lambda: ...) to update the UI.
The Reality: Tkinter is not thread-safe. Calling it from a worker thread doesn't always crash immediately. Sometimes, it just silently deadlocks, corrupts the event loop, or vanishes without a trace in the logs.

The Fix: I completely ripped out direct UI calls from workers. I built a custom, thread-safe event pump using queue.SimpleQueue (atl_ui_post / atl_ui_pump_start).
Now, background threads only drop payload functions into the queue. The main Tkinter thread polls this queue and executes the updates safely.
Workers never touch the UI. Period.

🛡️⏱️ 2. The "Frozen Main Thread" Vault Breach

The Nightmare: When a user locks their Windows PC (Win + L), ATLOCK is supposed to instantly lock the Vault and wipe the clipboard. But what if the main UI thread is busy rendering, blocked by an AV scanner, or frozen? The lock command gets queued... and your secrets stay exposed in RAM.
The Reality: Relying solely on the main thread for security-critical state changes is a single point of failure.

The Fix: A 3-second fail-safe timer mechanism.
When a session lock is detected, a background thread starts a 3-second countdown. If the main Tk thread fails to pick up the lock command in time, the background daemon forces the vault lock and nukes the clipboard anyway.
No exceptions. No silent failures. If the UI is frozen, the vault still locks.

📁🚫 3. The `Program Files` Permission Trap

The Nightmare: The app blindly assumed it could write its encrypted state to <script_folder>/.atlock_data.
The Reality: If a user places the app in a read-only directory like C:\Program Files or runs it from a restricted network drive, it throws a PermissionError on startup and bricks itself.

The Fix: Introduced _atl_pick_data_dir().
It actively probes the script folder for writability. If it passes, it runs in Portable Mode. If it fails, it gracefully falls back to storing data in the per-user %LOCALAPPDATA%\ATLOCK directory. The app now works flawlessly, regardless of where the user installs it.

🌐 4. Secure, Dependency-Free Networking

The Nightmare: Relying on the third-party requests library for Telegram alerts, with a fallback to a basic urllib implementation that didn't strictly enforce HTTPS and silently swallowed HTTP errors.
The Fix: Completely removed the requests dependency. I wrote a custom, highly secure urllib implementation (_atl_http_post) that strictly enforces HTTPS, properly formats multipart form-data for image/video uploads, and raises explicit errors if the Telegram API rejects the token. No more silent alert failures.

🧠 5. Exception Handling That Doesn't Lie

The Nightmare: Heavy reliance on bare except Exception: pass blocks, which hide critical failures and make debugging impossible.
The Fix: Introduced the _atl_swallow() helper. It safely catches background exceptions and logs only the exception type to atlock.log (never the text, which could leak paths or secrets), allowing the app to continue running smoothly while leaving a forensic trail.

⚔️ Let's Argue in the Comments (I Dare You)

I want to hear from you. Let’s spark a real discussion:

How do you handle background-to-UI communication in single-file Python apps? Are you risking tkinter deadlocks, or do you have a bulletproof queue system?
Is a 3-second fail-safe timer overkill, or is it the only acceptable standard for a security tool?
What’s the most terrifying "silent failure" bug you’ve ever hunted down in production?

Drop your war stories below. Let’s geek out over thread safety and fail-safes. 👇

🚀 The Final Countdown: 984 / 1000

ATLOCK v5 is a masterpiece of cryptographic engineering, thread-safe architecture, and fail-closed security. It is 100% built and ready to ship.

But as a community-driven project, we are waiting to cross the 1,000 total downloads milestone across all Akhouri Systems products (we are currently at 984).

Want to see what started it all? Want to test the waters before v5 drops?

🔗 Grab the current stable version (v4) right here:

👉 https://fn6qtj.s.gy/ATLOCK-v4

🔗 Star the repo, track the progress, and be the first to know when v5 drops:

👉 https://github.com/Akhouri-Anmol-Kumar/ATLOCK

Help us cross that 1,000 download mark. Share this post, star the repo, and let’s make ATLOCK the gold standard for local Python security suites.

See you in the comments. 💬🔥

Built with obsession by Akhouri Anmol Kumar @ Akhouri Systems.

We Built a Phone Upgrade Cycle Into a Security App (S25 S26, We See You

Akhouri Anmol Kumar — Sun, 04 Oct 2026 13:01:08 +0000

We Built a Phone Upgrade Cycle Into a Security App (S25 → S26, We See You)

Akhouri Systems · ATLOCK Security Suite

Let's talk about "upgrades" for a second.

Samsung drops the S25 Ultra, waits twelve months, slaps in a Snapdragon with a + next to it, adds a "privacy display" that just... dims when someone looks over your shoulder, and calls it the S26 Ultra. Ships it. Charges you full flagship price again.(in fact 15% more price than the launching price of s25 ultra)

And then there's the other guy. A fruit company. Forgot the bite mark was supposed to represent progress somewhere around 2015 and has been shipping the same titanium rectangle with marginally better glass ever since. The bite mark is doing more creative heavy lifting than the actual hardware roadmap at this point.

Meanwhile we've been sitting here at Akhouri Systems rebuilding our entire cryptographic core from scratch for a free desktop security suite, and nobody's even clapping yet. So let's fix that.

What ATLOCK Is

ATLOCK is a single-file, Windows-first, pure-Python security suite — screen lockdown, NTFS-ACL file guarding, an encrypted credential vault, and intruder-capture (photo + video) wired into one app(.exe). No subscription. No cloud. No telemetry phoning home to some VC's dashboard.

v4 is live right now: 👉 Download ATLOCK v4

v5 is done. Fully built. Sitting in the chamber. And it is not a "Gen+ chip and a privacy display" update — it's a ground-up rebuild of everything that actually matters in a security tool: the crypto, the storage format, and the attack surface.

The Technical Part (because talk is cheap)

Here's the actual diff, not marketing copy:

	v4	v5
Vault encryption	Fernet (AES-128-CBC + HMAC)	AES-256-GCM, authenticated, chunked
Key derivation	PBKDF2-HMAC-SHA256, 200k iters	HKDF + hardened key sealing
File containers	basic encrypted blob	Container format v3.1 — chunked AES-256-GCM, key commitment, per-chunk subkeys, optional Padme size padding, header-bound AAD
2FA	none	TOTP + FIDO2 hardware key support (YubiKey, WebAuthn)
Recovery	—	Shamir secret sharing (`--shamir-split` / `--shamir-join`) — split your recovery key across multiple people/locations, no single point of failure
Public-key crypto	—	Full `--pk-keygen / --pk-encrypt / --sign / --check-sig` pipeline, plus signed-release verification so you can confirm a build actually came from us
Anti-rollback	—	HardenedState sealed anchors resist clock/state rollback attacks
Self-defense	—	`--selftest`, `--canary-selftest`, `--fuzz` (stress-tests the container parser against random corruption), `--audit-verify`
Known v4 weak spot	a documented stealth recovery bypass, flagged openly in the v4 source as a ship-at-your-own-risk tradeoff	gone — rebuilt around FIDO2 + Shamir recovery instead of a hidden master sequence
Legacy data	—	v1-v3 containers and v4/v5 JSON vault/guard/settings files are auto-migrated, nothing left behind

This is what a real upgrade cycle looks like. Not "the same silicon, now 8% faster." A rewritten trust model.

The Pitch

v5 is 100% built, tested, and ready to ship. It is not gated behind more dev time, more testing, more "coming soon" vaporware energy. It's gated behind exactly one number:

Akhouri Systems is at 975 / 1000 total downloads across all products.

v5 unlocks at 1,000.

That's it. That's the whole gate. 25 downloads stand between you and a security suite that out-engineers products made by companies worth more than some countries' GDP.

So here's the move: go grab v4 right now — it's free, it's real, it works — and you personally become one of the 25 people who flip the switch on v5 for everyone.

👉 Download ATLOCK v4 here

Discuss

What's the most embarrassing "flagship upgrade" you've ever paid for?
FIDO2 vs TOTP vs Shamir recovery — which would you actually trust for a personal vault?
Anyone want to pressure-test the v5 container format once it's out? --fuzz is going to need friends.

Drop a comment, drop a download, let's hit four digits. 🔐

— Akhouri Anmol Kumar, Akhouri Systems

I Let an AI Audit My Password Vault. It Lied to Me With Total Confidence. 🔐

Akhouri Anmol Kumar — Sun, 04 Oct 2026 04:49:35 +0000

🚨 "Brother, I read the whole code carefully. These bugs are real."

That's how it started.

I'd been building ATLOCK, a Windows security suite with an encrypted password vault, file guard, 2FA, the works. v5 was nearly done. So I did what every developer does at some point: I pasted 8,500 lines of Python into an AI and asked,

"Any bugs?"

It came back with six. Emojis, severity colors, function names, even a smug little "I didn't invent these, you can verify them yourself."

Reader, I took that offer literally. 😏

🧪 The Rules of the Game

For every claim I did one thing: open the actual file and check.
No vibes. No trust. Just grep and line numbers.

Final score:

#	Claim	Verdict
1	Vault recovery key crashes	🔴 Real
2	Watchdog silently skips services	🤥 Fiction
3	Enabling 2FA locks you out	🟠 Real
4	HIBP request on every keystroke	🟡 Real
5	Wrong key derivation for v2 vaults	😇 Real, but harmless
6	Factory reset race condition	🟡 Real

Four real bugs, one fake, one harmless. Let's go through them. 🍿

💥 Bug #1: The Feature That Could Never Have Worked

Creating a Vault Recovery Key called this:

enc_b64 = base64.b64encode(bytes(self._sess.view())).decode("ascii")

And SecureBuffer looks like this:

class SecureBuffer:
    def get_bytes(self) -> bytes: ...
    def wipe(self): ...
    # view()? Never heard of her.

Click "Create Vault Recovery Key" → AttributeError. 💀
It's the one feature meant to save you when you forget your password, and it crashed on creation.

Fix: one line.

enc_b64 = base64.b64encode(self._sess.get_bytes()).decode("ascii")

Lesson: a recovery feature nobody tests is a recovery feature that doesn't exist.

🔒 Bug #3: Enabling 2FA Locked Me Out of My Own Vault

This one is my favorite, because it's sneaky.

When you enable TOTP in Settings, the app creates a fresh PasswordVault(), writes the 2FA config to disk, and shows you a lovely QR code. Everything looks perfect.

But the main app is holding a different vault object, loaded once at startup, with a memory that has no idea 2FA now exists.

So you lock the vault, try to unlock it, and your own app says:

"TOTP is required by your security policy but not set up. Access denied." 🙃

Yes. The policy says "2FA required", the stale in-memory copy says "2FA doesn't exist", and the vault, being a good fail-closed security tool, slams the door on you.

Funny part: it's the safe kind of bug. Annoying, but it never leaked anything. A password manager that locks you out beats one that lets everyone in. 😅

Fix: re-read the 2FA config from disk right before checking the second factor.

def _sync_mfa_from_disk(self):
    with contextlib.suppress(Exception):
        disk = atlock_read_json(self._path, None)
        if isinstance(disk, dict):
            if isinstance(disk.get("mfa"), dict): self._db["mfa"] = disk["mfa"]
            else: self._db.pop("mfa", None)

# in unlock(), right before the 2FA check:
self._sync_mfa_from_disk()
ok2, msg = atl_second_factor(self._db, master, "Vault unlock", ask_code=self.ask_code)

Bonus: this also covers someone enabling 2FA from the CLI while the app is open.

🌐 Bug #4: Typing a Password Sent a Small Army of Network Requests

When you add a vault entry, ATLOCK checks your password against Have I Been Pwned. Great feature. Terrible implementation:

self._pw_e.bind("<KeyRelease>", self._on_password_change)  # every. single. key.

Type a 12-character password and the app spawns about 7 threads and 7 API calls. Rate limits and UI lag, free of charge.

Fix: a classic debounce. Wait until the user stops typing for 700 ms, then check once.

self._hibp_after = self.after(700, lambda: self._run_hibp(pw))

If the password changed while the request was in flight, the stale result is thrown away. No more flickering "✓ Safe" labels for passwords you've already deleted.

🗑️ Bug #6: Factory Reset vs. The Process That Wouldn't Leave

Factory Reset worked like this:

Spawn a new process that deletes everything
Close the current app

The problem: step 1 happens while the old app still holds its file handles. On Windows, deleting a file another process still has open gives you PermissionError, and you get a half-erased reset. Spooky. 👻

Fix: the reset process now receives the parent's PID and politely waits for it to exit.

subprocess.Popen([sys.executable, sys.argv[0], "--reset",
                  f"--reset-wait-pid={os.getpid()}"])

On Windows it waits on the process handle (up to 10 seconds) before wiping anything. Manners matter, even in a destructive operation.

😇 Bug #5: Real, But Nobody Is Ever Affected

The claim: Quick Lock always derives the master key with the legacy v1 function, even for v2 vaults.

True in the code. But I traced who can ever reach it: TOTP and FIDO2 setup require a v3 vault. A legacy v2 vault can never have a second factor, so there's nothing to unwrap with the wrong key.

So: technically inconsistent, practically unreachable. I left it alone. Knowing what not to fix is also engineering. 🧘

🤥 Bug #2: The One That Never Existed

The most dramatic claim:

"Watchdog calls DefenderGuard.run_ps, but the method is _run_ps! It silently skips services and scheduled tasks! A big hole in persistence detection!"

It even offered proof: "the WMI function spells it correctly, so the other two are obviously typos."

I searched the entire file:

grep -n "DefenderGuard\.run_ps" ATLOCK_V5.py
# (nothing)

Zero results. Every call was already _run_ps. The bug was invented, complete with a convincing explanation of how it happened and why it matters.

And the best part? I fed the fixed file back to the AI, and it confidently re-confirmed all the old bugs, including the fake one, even the ones I'd already fixed. It even reproduced the typo with a stray space (DefenderGuard. run_ps) that exists nowhere in my code. 🤡

🧠 What I Actually Learned

1. AI code review is a great scout, and a terrible judge.
It found four real bugs I'd missed. That's genuinely valuable. It also invented one with the same confident voice. You can't tell them apart without checking.

2. Demand line numbers.
A real bug can be pointed at. If a claim has no line number, it's a rumor.

3. grep is a lie detector.
Every claim here took about ten seconds to verify. Ten seconds beats a week of "fixing" a bug that doesn't exist.

4. Trace before you fix.
Bug #5 was real and still not worth a patch. Reachability matters more than correctness-in-the-abstract.

5. Fail-closed bugs are the good kind of bad.
When your security tool breaks, it should break shut.

🛡️ So... What's ATLOCK?

ATLOCK is a Windows security suite by Akhouri Systems: an Argon2id-based encrypted password vault, file guard, TOTP and FIDO2 2FA, panic/decoy vault, breach checks, startup watchdog, and more.

📦 v4 is out now: Download ATLOCK v4
🔥 v5 (everything you just read about) is coming soon, and I'm releasing it when Akhouri Systems crosses 1,000 downloads.
📊 Current progress: 967 / 1000

That's 33 downloads away. If you've ever wanted to be the reason a security tool ships its next version, you know what to do. 😄

⭐ Repo: github.com/Akhouri-Anmol-Kumar/ATLOCK

💬 Your Turn

Has an AI ever confidently "found" a bug that didn't exist in your code? Drop your best hallucination story below. 👇 I'll start a collection.

Built by Akhouri Anmol Kumar, one very suspicious grep at a time. 🔍

Auditing My Own Encryption Tool: 6 Bugs That Looked Fine Until They Weren't

Akhouri Anmol Kumar — Sat, 03 Oct 2026 11:44:29 +0000

Description: "An infinite loop in chunked AEAD, a 2FA lockout, a shredder that wrote one byte, and more. A technical walkthrough of bugs found in ATLOCK v5, a Python file-locking tool."

I build ATLOCK, a Windows file and folder locking tool in Python. It uses
Argon2 key derivation, chunked AES-GCM containers, a password vault with TOTP
2FA, and a "panic password" that opens a decoy vault.

Before shipping the next version, I audited the whole file (about 8,500
lines). Most of what I expected to find, such as OCR-style corruption, bad
indentation and trailing spaces in strings, turned out not to be present. The
interesting bugs were logic bugs in security-sensitive paths. Here are the
real ones, with the reasoning and the fixes.

📦 Availability

ATLOCK v5 is not released yet. It ships when Akhouri Systems crosses
1,000 downloads, and we're currently at 959.

In the meantime you can try ATLOCK v4 here:
https://fn6qtj.s.gy/ATLOCK-v4

Everything described below is part of the v5 work. v5 is the upgrade
path once the milestone is hit.

1. The infinite loop in chunked encryption

ATLOCK writes containers as a stream of AES-GCM chunks. The header declares
the plaintext length up front, and each chunk is authenticated with
associated data (AAD) that binds three things:

the header hash
the chunk index
a flag marking whether it is the final chunk

Simplified, the encrypt loop looked like this:

while True:
    chunk = fh_in.read(chunk_size)
    is_final = (written + len(chunk) >= plain_len)
    nonce = nonce_base + struct.pack(">I", idx)
    aad = header_hash + struct.pack(">I", idx) + (b"\x01" if is_final else b"\x00")
    ct = aes.encrypt(nonce, chunk, aad)
    # ... write, written += len(chunk), idx += 1
    if is_final:
        break

is_final is computed from written, which only grows when read()
returns data. If the source file shrinks while it is being read
(another process truncates it, a sync client rewrites it, a user saves),
read() returns b"". written stops increasing and is_final never
becomes true. The loop spins forever, writing empty encrypted chunks, and the
app freezes.

The tempting fix is wrong

The obvious patch is to force termination:

if not chunk:
    is_final = True

This ends the loop, but it produces a silently corrupt vault. The header
already promises plain_len bytes. The reader derives "is this the last
chunk?" from that length, so it will expect the final-flag AAD at a different
point than the one you wrote. Decryption fails authentication, and you find
out only when the user needs the data. A freeze is better than that, because
at least it is visible.

The fix

Fail loudly, and also stop reading past the declared length so a file that
grows can't be silently truncated:

chunk = fh_in.read(min(chunk_size, max(plain_len - written, 0)) if plain_len else 0)
if not chunk and written < plain_len:
    raise AtlockDamaged(
        "Source file changed size during encryption (it became shorter). "
        "Nothing was replaced; please retry."
    )
is_final = (written + len(chunk) >= plain_len)

I tested four cases: a shrinking source (raises, does not hang), a growing
source (round-trips to exactly the declared length), an empty file, and
normal files.

Lesson: when the format commits to a length in the header, never let the
loop terminate on anything but that length.

2. A 2FA lockout for legacy vaults

Quick Lock re-authenticates the user, then runs the second factor. For
legacy (pre-v3) vaults there is no v3 master section, so the derived
master key is None. The call site did this:

atl_second_factor(db, master or b"", "Quick Lock", ...)

The TOTP seed is stored wrapped under the master key. Unwrapping it with an
empty key always fails authentication. Anyone on a legacy vault with a TOTP
policy would fail Quick Lock every time, with no way back in.

The fix is to derive the real key with the legacy KDF before discarding the
password:

if legacy_ok and master is None:
    with contextlib.suppress(Exception):
        master = atlock_legacy_key(pwd, base64.b64decode(db["master_salt"]))
del pwd

One caveat I verified before claiming too much: TOTP can only be configured
on migrated vaults, so a pure legacy vault has no seed to unwrap. In that
case the existing behaviour (denied, "not set up") is still the correct
fail-closed result. The change makes the code correct instead of relying on
that accident.

Lesson: x or b"" as a default for key material is a smell. A dummy key
doesn't fail safe. It fails permanently.

3. The shredder that wrote one byte

This one is my favourite because two bugs combined.

Bug A: the return value was ignored. After re-encrypting a guarded file,
the code securely deleted the plaintext working copy:

atlock_shred(temp)   # returns False if it couldn't delete

On Windows, if the user leaves the file open in Word or Notepad, the delete
fails with WinError 32 (sharing violation). atlock_shred returned False
correctly, but the caller dropped its "pending re-encrypt" record anyway. The
result was a plaintext file sitting on disk with nothing tracking it.

The fix is to treat a failed shred as a failed operation, so the retry timer
and the on-startup recovery keep the record:

if not atlock_shred(temp) and os.path.exists(temp):
    raise PermissionError("working copy is still open in another program")

I also added a "Please close the file" notification on the first failure,
instead of leaving the user to find out from a log line. Retries run every 15
seconds for up to 10 minutes.

Bug B: the zero-fill pass wrote 1 byte.

f.write(b"\x00" if p == 0 else secrets.token_bytes(n)); left -= n

Pass 0 wrote a single byte per block-sized step, while left was
decremented by n. The zero pass barely touched the file. The random pass
was correct. The fix:

f.write(b"\x00" * n if p == 0 else secrets.token_bytes(n)); left -= n

An honest caveat: on SSDs with wear levelling, or on copy-on-write and
journaling filesystems, overwriting in place is not a guarantee of
irrecoverability anyway. Shredding is best-effort hygiene, not a
forensic-grade guarantee, and the docs should say so.

4. The old panic password survived key rotation

ATLOCK has a panic password that opens a decoy vault. Vaults migrated from the
old format carry that panic slot into the new one. rotate_master replaced
the real master key but left the panic slot untouched, so after rotating
because "my password leaked", the old panic password still opened the
decoy forever.

I can't re-derive the panic hash without the panic password, so the right
move is to retire the slot. I replaced it with an inert slot of the same
shape (so the file doesn't reveal that anything changed) and a fresh random
decoy blob, and told the user to set a new panic password:

if psec0.get("legacy"):
    self._db["panic"] = {
        "salt": base64.b64encode(secrets.token_bytes(16)).decode(),
        "kdf": sec["kdf"],
        "verifier": secrets.token_hex(32),
        "real": False,
    }
    self._db["decoy_entries_enc"] = "gcm3:" + base64.b64encode(secrets.token_bytes(64)).decode()

I also made rotation reject a new master password that equals an active panic
password, which would otherwise make both open the same vault.

A user-chosen panic password on a v3 vault is independent of the master key,
so I left those alone. The bug was specifically the carried-over legacy slot.

5. Hammering the HIBP API

The vault's health audit checks every password against Have I Been Pwned
using the k-anonymity range API. It did so in a tight loop. With 50 or more
entries, you hit rate limits and the later checks fail quietly.

Fixes:

time.sleep(0.5) between real requests
a per-audit cache, so identical passwords are looked up once
stop after the first offline or rate-limited result, instead of waiting for a timeout on every remaining entry

if pw not in hibp_cache:
    if hibp_calls:
        time.sleep(0.5)
    hibp_calls += 1
    hibp_cache[pw] = atlock_hibp_check(pw)
    if hibp_cache[pw] is None:
        hibp_offline = True

The audit already ran on a worker thread, so the delay doesn't freeze the UI.
A test with 5 unique passwords plus one duplicate made 5 calls and 4 sleeps,
as expected.

6. Compiling with Nuitka: `sys.frozen` isn't set

This isn't a classic bug, but it would have bitten me in production.
PyInstaller sets sys.frozen. Nuitka does not. My code decided how to
re-launch itself (background agent, Explorer context menu, factory reset)
with:

if getattr(sys, "frozen", False):
    return [sys.executable, "--background-agent"]

In a Nuitka build that check is false, so the code takes the "running as a
.py" path and builds a broken command line. Nuitka injects a module-level
__compiled__ instead:

IS_COMPILED = bool(getattr(sys, "frozen", False)) or ("__compiled__" in globals())

def atl_self_exe() -> str:
    if IS_COMPILED:
        p = os.path.abspath(sys.argv[0]) if sys.argv and sys.argv[0] else sys.executable
        for c in (p, p + ".exe"):
            if os.path.isfile(c):
                return c
    return sys.executable

I also skipped the importlib.util.find_spec dependency pre-check in
compiled mode, since everything is already bundled, and pointed the
release-signature hash at the .exe instead of a .py that no longer exists.

I recommend --standalone over --onefile for this kind of tool. Onefile
unpacks to a temp directory on every launch, which makes self-integrity
checks and registry or scheduled-task paths less predictable.

What I didn't find

An early checklist claimed the file was full of OCR damage: broken dunder
methods, isinstan ce, 1 < < 20, trailing spaces inside every string, and
mixed indentation. I verified each item mechanically and none of it was
there. I used tokenize for the string literals and indentation steps, and
pyflakes plus py_compile for names and syntax.

The lesson is to verify a claimed bug list against the actual file before
"fixing" it. The real bugs were subtler and more dangerous than formatting
problems.

Takeaways

Don't terminate loops on convenience. If a format commits to a length, mismatches should be errors, not quiet terminations.
Placeholder key material (or b"") fails closed forever. Derive the real key, or deny cleanly with a reason.
Always check the result of security-relevant cleanup, such as deletes and shreds. A swallowed False leaves plaintext behind.
Test the helper's internals, not only its API. b"\x00" vs b"\x00" * n passes every "it returned True" test.
Key rotation must cover every credential derived from the old state, including secondary ones like panic and decoy slots.
Know your compiler's markers. Nuitka and PyInstaller differ here.

What I couldn't test on Linux: the Windows-specific parts (the Quick Lock
dialog, real WinError 32 file-lock retries, and the compiled .exe). I
tested those by reading and by simulating the code paths, so I'm calling them
unverified on real Windows until I've run them there.

Try ATLOCK

v5 is coming once Akhouri Systems reaches 1,000 downloads (we're at 959,
so very close). Until then, grab ATLOCK v4 and upgrade when v5 lands:

👉 https://fn6qtj.s.gy/ATLOCK-v4

If you find a bug in the tool, I'd like to hear about it, and I'll write it up
the same way.

A stranger publicly roasted my encryption tool. He was right. Here's the bug that said "SAFE ✅" while offline.

Akhouri Anmol Kumar — Fri, 02 Oct 2026 08:15:38 +0000

Description: I let a reviewer pick apart my encryption tool. He found a bug that told users "safe" when it meant "unknown". Here's every fix, the attacks I ran on my own files, and how to get v5 early.

Last I posted about ATLOCK v5, my encryption and password-vault tool. Within hours, a reviewer left a comment longer than most of my commits.

It was polite. It was precise. It was devastating.

I could have gotten defensive. Instead I opened the code and tried to prove him wrong.

Some of it, he was. Here's what I found.

🐛 Bug #1: the "SAFE ✅" that meant "I have no idea"

ATLOCK checks your passwords against known breaches using the Have I Been Pwned range API. Only a 5-character hash prefix ever leaves your machine. Your password never does.

The flaw: if the check couldn't run (offline, blocked, timed out), the code quietly returned "not breached", and the UI showed a calm green "Safe from breaches."

A security tool saying safe when it means unknown is the worst kind of bug, because it looks like it's working.

# before: couldn't check -> "not breached"
return (False, 0) if n is None else (bool(n), n)

# after: unknown stays unknown
return (None, 0) if n is None else (bool(n), n)

Now it says "Could not check, NOT verified." The vault health audit has its own "could not be checked" section. Silence is no longer a green tick.

🚪 Bug #2: three network calls that trusted too much

Three urlopen calls accepted whatever URL scheme came along and followed redirects wherever a server pointed them. Now every request goes through one helper that:

refuses anything that isn't https
refuses a redirect to anything that isn't https
always applies a timeout and a response size cap

One door. One lock.

🔨 "Your 200 bit-flip test mostly tests GCM's tag"

Ouch. And fair.

Flipping random bits proves AES-GCM's tag works. It doesn't prove my chunk logic works, and that's exactly where chunked encryption breaks: reordering, duplication, truncation.

So I wrote the attacks he described and aimed them at my own encrypted files:

Attack on an encrypted file	Result
Flip one bit in every single header byte	❌ rejected
Swap two chunks	❌ rejected
Duplicate one chunk over another	❌ rejected
Drop the first chunk	❌ rejected
Append an extra chunk	❌ rejected
Truncate exactly on a chunk boundary	❌ rejected
Cut the file at an earlier "valid-looking" point	❌ never opens as a whole file

Every chunk authenticates its own index and a final-chunk flag, so a truncated file can never pass for a complete one.

🔑 Sender pinning: fail closed, not "please read the warning"

If you pin a sender's public key and the file is unsigned or signed by someone else, ATLOCK refuses. It raises an exception before any plaintext is written. Reading it anyway takes an explicit allow_sender_mismatch=True.

Why not just warn? Because a warning only works if a human reads it. A return value like {'signed': True, 'signer_matches': False} is exactly what a script checks halfway and ignores. The new test confirms that on a mismatch, nothing is left on disk.

🧾 What I am NOT claiming

I'd rather you hear it from me:

No third-party audit. The crypto primitives come from cryptography and argon2-cffi, which wrap audited libraries. ATLOCK's own container format and key handling have not been independently reviewed. The self-test and fuzzer are mine, not an audit.
Python can't reliably wipe secrets from RAM. Keys and passwords can linger in memory or swap. It's in the docs now.
It protects data at rest. It won't save you from malware already running as you, a keylogger, or a weak password.

A short threat model now ships in the docstring too.

🔓 The part where you come in

ATLOCK v5 is finished, but it isn't public yet.

I'm releasing it when Akhouri Systems crosses 1,000 downloads.

Akhouri Systems downloads
[█████████████████████████████░░░] 940 / 1000

60 downloads. That's all that stands between you and v5.

You can grab the current public version, ATLOCK v4, right now:

👉 Download ATLOCK v4

Here's why I'm asking you to try it:

You help unlock v5. Every download moves the bar.
You'll know exactly what v5 improves. Everything above is going into it.
Your feedback shapes the release. Reviewers like the one who roasted me are the reason v5 is better than the post I originally wrote.

💬 How to help (30 seconds)

⬇️ Download v4 and break something
⭐ Star the repo so more people find it: github.com/Akhouri-Anmol-Kumar
🗨️ Comment below with the one thing you'd attack first. If it's good, I'll test it on my own files and write up the result, the way I did here.

And if you're the reviewer who started all this: thank you. You made v5 better, and I mean that.

See you at 1,000. 🔐

I Built a Desktop Image Toolkit in Python — One App, Six Workspaces, Zero Browser Tabs 🖼️

Akhouri Anmol Kumar — Fri, 02 Oct 2026 06:00:31 +0000

What if image editing, format conversion, compression, and image search didn't require juggling multiple websites and applications?

That question is part of what led me to build APIC — Advanced Image Processing Center, an image-processing desktop application developed under Akhouri Systems.

And no, this isn't another article that just says, “I built an app, please download it.”

Let's look at the actual application architecture, the UI design, the workflow decisions, and why I'd like developers to put APIC through its paces.

⚡ First, what is APIC?

APIC is a desktop application built with Python and PyQt6. Its goal is to bring several image-related workflows into a single desktop interface.

Instead of jumping between separate tools, APIC organizes its functionality into dedicated workspaces.

🧰 Meet the six workspaces

Workspace	Purpose
🏠 Home	Starting point for opening images and accessing workflows
✏️ Edit	Image-editing workspace
🔄 Convert	Image conversion workflow
📦 Compress	Image compression workflow
🔎 Search	Dedicated image-search workspace
ℹ️ About	Application information and product details

The idea is simple: one application, separate workflows, consistent navigation.

You don't need to learn an entirely different interface every time you switch tasks.

🧠 Under the hood: How APIC is structured

Here's where things get interesting from a development perspective.

APIC isn't built as one enormous window with every feature crammed into it. Its main window coordinates separate screens and switches between them.

The application uses Python with PyQt6, including QMainWindow, QStackedWidget, layouts, buttons, signals, and slots.

The high-level structure looks like this:

APIC
│
├── Main Window
│   ├── Sidebar Navigation
│   ├── Stacked Content Area
│   └── Status Bar
│
├── Home Screen
├── Edit Mode
├── Convert Mode
├── Compress Mode
├── Search Mode
└── About Screen

The main window creates the individual screens and registers them in a dictionary. The QStackedWidget holds those screens, while the sidebar tells the application which screen to display.

For example, the navigation logic follows this pattern:

def _navigate(self, key: str):
    if key not in self._screens:
        return

    self._current_mode = key
    self.stack.setCurrentWidget(
        self._screens[key]
    )
    self.sidebar.set_active(key)

Why is this useful?

Separation of concerns: Each workspace has its own module.
Centralized navigation: The main window controls screen switching.
Maintainability: Changes to one workspace can often be isolated from the others.
Consistent UI: The sidebar and status bar remain part of the main application shell.

This is a practical example of organizing a desktop application into manageable components rather than letting the main window become responsible for everything.

Of course, modularity alone doesn't guarantee good software. Each module still needs proper error handling, testing, and clear interfaces.

But it's a useful architectural foundation.

🔀 One interesting design decision: File routing

Opening an image sounds trivial until an application needs to decide what to do with one file versus several.

APIC handles these cases differently.

Open one image: The application records the file in its recent-file list, loads it into Edit Mode, and navigates to that workspace.

Open multiple images: The selected paths are added to Convert Mode, and the application switches to the converter.

Here's the simplified decision:

if len(paths) == 1:
    self.home_screen.add_recent_file(paths[0])
    self.edit_mode.load_image(paths[0])
    self._navigate("edit")
else:
    for path in paths:
        self.convert_mode.add_file(path)

    self._navigate("convert")

This is a small piece of code, but it demonstrates an important UX principle:

The application should respond to the user's workflow, not force the user to navigate manually after every action.

A developer building a media manager, document utility, or batch-processing application could apply the same pattern.

⌨️ Keyboard shortcuts aren't an afterthought

A desktop application should work well for mouse users and keyboard-oriented users.

APIC includes global shortcuts for opening files and navigating between workspaces.

Shortcut	Action
`Ctrl + O`	Open images
`Ctrl + 1`	Home
`Ctrl + 2`	Edit
`Ctrl + 3`	Convert
`Ctrl + 4`	Compress
`Ctrl + 5`	Search
`F1`	About

These shortcuts are implemented using PyQt6's QShortcut and QKeySequence.

For example:

shortcuts = {
    "Ctrl+O": self._global_open,
    "Ctrl+1": lambda: self._navigate("home"),
    "Ctrl+2": lambda: self._navigate("edit"),
    "Ctrl+3": lambda: self._navigate("convert"),
    "Ctrl+4": lambda: self._navigate("compress"),
    "Ctrl+5": lambda: self._navigate("search"),
    "F1": lambda: self._navigate("about"),
}

Notice that navigation shortcuts reuse the same navigation function as the sidebar.

That means both input methods follow the same screen-switching logic instead of implementing separate navigation behavior.

It's a small detail, but small details accumulate into a more consistent application.

🖱️ Drag, drop, and supported formats

APIC also supports opening images through drag-and-drop.

The main window checks whether the incoming event contains URLs, accepts the proposed drop action, and extracts local file paths when the files are dropped.

The code filters the dropped files using their extensions.

The supported extensions include:

PNG · JPG · JPEG · WEBP · BMP · TIFF · TIF · GIF · ICO · HEIC · AVIF

The file dialog uses a corresponding image-file filter.

One technical distinction worth understanding: accepting a file extension doesn't automatically guarantee that every image encoded in that format can be decoded on every machine. Actual support depends on the image-loading and processing implementation and its available codecs.

That's precisely the kind of thing I'd like testers to investigate.

🎨 The interface matters, too

A utility can be technically functional and still be frustrating to use.

APIC uses a dedicated sidebar, a stacked content area, a dark-theme stylesheet, and a status bar. The sidebar separates navigation from the workspace itself, allowing the active task to occupy the main content area.

The application also connects status-message signals from its workspaces to the main window's status bar.

In practical terms, that gives individual workspaces a way to communicate status information without requiring each one to manage the main window's status bar independently.

The result is a desktop-oriented structure rather than a website wrapped inside an application window.

And yes, there's still room to improve it. That's why real-world feedback matters.

🧪 Here's where you come in: Test APIC

I don't want you to download APIC, open it once, and forget about it.

I want developers, students, designers, and people who work with images to actually try it.

If you decide to test APIC, here are a few useful experiments:

Open a single image and inspect the Edit workflow.
Select multiple images and inspect how the application routes them to Convert Mode.
Try the keyboard shortcuts instead of clicking the sidebar.
Test drag-and-drop with different supported image formats.
Check how the application responds to invalid paths, unreadable files, or unusual image dimensions.
Look for interface inconsistencies, unexpected behavior, and workflow friction.
If you encounter a bug, report the steps needed to reproduce it.

Please don't assume that every feature is flawless just because it has a dedicated screen. The real question is how reliably each workflow behaves under actual use.

Useful bug reports are more valuable than vague feedback.

If something breaks, tell me what you did, what you expected, and what actually happened.

📥 Ready to try APIC?

You can get the application here:

👉 DOWNLOAD APIC — Advanced Image Processing Center

Want to inspect the project first?

Explore the APIC source repository on GitHub

Download the application, explore its workspaces, and see how it fits your workflow.

If you're a Python developer, I'd especially like to hear your thoughts on the PyQt6 architecture, navigation design, file handling, and areas that need improvement.

👨‍💻 A little about the developer

I'm Akhouri Anmol Kumar, founder of Akhouri Systems.

I build software with a focus on practical desktop utilities, straightforward workflows, and applications that people can actually use.

APIC is one of those projects: take a common category of work, organize it into a coherent interface, and keep improving it through real usage and feedback.

I'm still learning, building, testing, and refining.

And I believe independent software becomes more useful when developers invite people to examine it critically instead of treating every release as a finished masterpiece.

💬 Let's talk image-processing workflows

I have three questions for developers and people who work with images:

Which image-processing tasks do you perform most often: editing, converting, compressing, or something else?
What's one feature you wish more desktop image tools offered?
If you try APIC, what's the first thing you'd improve?

Drop your thoughts in the comments. If you find a reproducible bug, please include the steps.

Try it. Explore it. Challenge it. Help me make it better.

If APIC proves useful in your workflow, a GitHub star or a share with another developer would also help the project reach more people.

Thanks for reading. 🚀