CredKit
Cryptographic credential issuance and verification — plus a self-led security audit that found and fixed real vulnerabilities
What I did
The problem
Digital credential platforms need cryptographic integrity — credentials must be tamper-evident, verifiable without contacting the issuer, and revocable when needed.
The solution
Built the credential lifecycle as a set of API endpoints: issuance with cryptographic signing, recipient validation, revocation with status propagation, and shareable verification links. Payment integration uses Flutterwave. Batch issuance handled via BullMQ/Redis queues with Upstash rate limiting.
Key features
- Cryptographic credential issuance and verification
- Tamper-evident shareable verification links
- Credential revocation with status propagation
- Flutterwave payment integration with webhook service
- Batch issuance via BullMQ/Redis with rate limiting
- Phased security remediation roadmap
Engineering highlights
★Self-Led Security Audit
After building the platform, conducted a forensic security audit that identified three critical vulnerabilities: an unauthenticated payment endpoint, an IDOR on batch issuance, and plaintext-stored private keys. Produced a phased remediation roadmap.
Engineering decisions
Batch credential issuance could overwhelm the API under load
Offloaded batch processing to BullMQ/Redis queues with Upstash rate limiting
Batch issuance processes asynchronously without blocking the API.
Technology stack
Impact
Lessons learned
The most valuable thing I did with CredKit wasn't building it — it was breaking it. Self-led security audits are incredibly high-signal.
Ready to build something exceptional?
Let's discuss how custom software can accelerate your business outcomes.