KT/Studio
Bookings openStart a project

About · one person, on purpose

Everything I've built started with something breaking.

I'm Kalyan Tamarapalli, and KT/Studio is me. I design, build and secure websites for small businesses. My background is security engineering, so I build every site as if someone is going to audit it. I work with businesses wherever they are.

No team page, no stock photos of people pointing at laptops. You deal with the person doing the work, and the work speaks for itself.

01 · 2025

Shipped

SecureNotes

What broke. I read about a major cloud breach and deleted every sensitive file I had stored in the cloud that same day. Then my LinkedIn account was hacked.

What I built. A local-first notes app where each note is locked by its own hardware key. The key is derived inside a YubiKey (FIDO2 WebAuthn PRF) and never stored anywhere. Unlocking takes the physical key, a PIN and a live touch.

“Treat other people's data as if it were your own.”
  • AES-256-GCM, per note
  • No cloud, no server ever sees a note
  • Even a full copy of the device can't open a locked note

For your website: Your site collects only what it needs, sends it nowhere it shouldn't, and every account sits in your name with 2FA.

02 · Feb 2026

Published

Attestia

What broke. Thirty days stuck on one pipeline error. When it finally ran, I deployed broken code by mistake, and the pipeline shipped it without a question.

What I built. A deployment-authorisation architecture that moves trust from software to a human hand: every production deploy needs a physical hardware approval, given on an isolated device, at that moment. Five versions, from a cloud MVP to a forensic black box, a risk engine with a covert duress signal, and a supply-chain verifier.

“Automation is not authorisation.”

Read the monograph · DOI 10.5281/zenodo.18450179 ↗

  • Five architecture versions in about 80 working hours
  • Estimated overhead: 1.5–3.5 s per deploy, under 3% of a typical pipeline
  • 22-page monograph · 103 views · 90 downloads on Zenodo

For your website: Nothing goes live on your site without tests, my sign-off and a way back. And nothing launches without yours.

03 · 2026

Paused, on purpose

The Blind Oracle

What broke. The design was ready. The resources weren't: always-on secure hardware, a twelve-week build, and a scope bigger than one person.

What I built. Zero-knowledge cloud storage that could search your files without ever seeing them: the search runs inside hardware-isolated memory, the password never reaches the server (OPAQUE), and the heavy encryption runs in the browser (Rust/WebAssembly).

“Know when the scope is bigger than the resources, and say so.”
  • Specified end to end
  • Explored on cloud enclaves and on a Raspberry Pi's TrustZone
  • Paused before a single corner was cut

For your website: Your quote is fixed and honest from day one. If something doesn't fit the budget, I tell you before I start, not after.

04 · Now

Open

KT/Studio

Small businesses get sold websites the way people get sold used cars: vague prices, a slick demo, and problems that show up later. A slow page on a phone. A quote form that lands in spam. Tracking scripts nobody remembers adding. An accessibility letter in the post.

So now I break things on purpose, before your customers do. I start with the problem, not the design: your business, your town, your competitors. Then I design, build, and test it until I can show you the reports.

“Find the problem first. Then build the answer.”
  • Astro: static sites that load in about a second
  • Cloudflare: hosting on your own account
  • axe, Lighthouse and the NVDA screen reader for testing
  • Three.js and WebGL only when they earn their place

I won't promise rankings or "lawsuit-proof". I promise the work, and I show it.

Research

Attestia, the monograph.

A Hardware-Rooted Zero-Trust Deployment Architecture for CI/CD Pipelines. A 22-page preprint, published open-access on Zenodo on 1 February 2026.

It moves the root of trust for a deployment from a software session to a human's physical approval, across five architecture versions.

Read it on Zenodo ↗DOI 10.5281/zenodo.18450179

Have a website that needs work?

Send it over. You'll get a free audit, or a written plan with a fixed price, the same working day.

Start a project →Free audit