Shubhojeet.
ProjectsBlogConnect
← All projects
August 1, 2026

Bastion

Bastion is a Chrome MV3 extension that PIN-locks websites at the network layer with one master PIN, per-tab sessions, brute-force lockout, and a recovery phrase.

External linkLive project

Overview

Bastion intercepts locked sites at the network layer using Chrome's declarativeNetRequest API. The request is redirected to a local challenge page before any real page data is fetched, so the locked site never touches the tab.

Bastion intercepts locked sites at the network layer using Chrome's declarativeNetRequest API. The request is redirected to a local challenge page before any real page data is fetched, so the locked site never touches the tab.

Unlocking is per tab. The four-digit PIN is hashed with PBKDF2 and a random salt, stored only in chrome.storage.local, and verified by the service worker. A six-word recovery phrase is generated during setup, and three failed attempts trigger a cooldown that re-locks every open tab on that domain.

How It Was Built

The main technical choices behind the product, from system design to the parts that make it work day to day.

  • Shipped a Chrome MV3 extension with a Vite + React + TypeScript + Tailwind CSS stack and shadcn-styled components for the popup, options, and challenge pages.
  • Built network-layer blocking with chrome.declarativeNetRequest dynamic rules, so the redirect happens before the request leaves the browser.
  • Shipped a Chrome MV3 extension with a Vite + React + TypeScript + Tailwind CSS stack and shadcn-styled components for the popup, options, and challenge pages.
  • Built network-layer blocking with chrome.declarativeNetRequest dynamic rules, so the redirect happens before the request leaves the browser.
  • Implemented per-tab unlock sessions in chrome.storage.session, keeping each tab isolated while allowing instant re-lock with Alt+Shift+L or Option+L.
  • Added brute-force protection that clears all active sessions for a domain and enforces a cooldown after three wrong PIN attempts.
  • Built a recovery-phrase flow for PIN resets and a typed-RESET nuclear reset that wipes all data without requiring the original PIN.
  • Created the Next.js 16 landing page at bastion.shubhojeet.me with 100/100/100/100 Lighthouse scores, Geist typography, and full OG/Twitter metadata.

Impact

  • Stops the real page from loading, which prevents cached previews, autoplay media, and inspect-element workarounds that rely on already-loaded content.
  • Removes the need for per-site passwords by using one master PIN and a recoverable phrase.
  • Stops the real page from loading, which prevents cached previews, autoplay media, and inspect-element workarounds that rely on already-loaded content.
  • Removes the need for per-site passwords by using one master PIN and a recoverable phrase.
  • Raises the cost of bypass attempts by enforcing cross-tab lockouts and local-only credential storage.

Highlights

  • Network redirect before the request, not an overlay after render.
  • Per-tab unlock with cross-tab brute-force lockout.
  • Network redirect before the request, not an overlay after render.
  • Per-tab unlock with cross-tab brute-force lockout.
  • PBKDF2-hashed PIN, recovery phrase, and zero plaintext storage.

Tech Stack

Chrome MV3ReactTypeScriptTailwind CSSNext.js 16

More Projects

Additional work across AI products, developer tooling, and full-stack systems.

Browse all →

Next.js 16

Edward

An AI coding workspace where developers can describe apps in plain language, generate production-ready code, inspect and edit files in real-time, run projects in isolated Docker environments, publish live previews, and sync everything directly to GitHub without leaving the product.

View projectArrow right

Next.js 16

Agentic Chat

An AI chat platform that routes each request through the right context — memory, documents, tools, or research — and acts on the answer through connected apps.

View projectArrow right

Next.js

Bonkers by Foyer

Creative production system built at Foyer Tech — led the v2→v3 rebuild with reusable templates, multi-model routing, and faster repeat workflows for high-quality visual asset creation.

View projectArrow right