10ck/lɒk/
Four characters, one idea: lock the noise out. A one-person workshop building secure, dependency-free, privacy-first software — tunnels, Telegram bots, AI browser agents and developer tools that ship small and behave well.
dependencies none
logs stored 0
It reads as a number. It means lock.
1337-speak, four keystrokes, zero ambiguity once you see it. Tap a tile to decode it.
Built, broken, understood — in that order.
Privacy is the default
No content stored, no analytics beacons, no “anonymous” telemetry. If a feature needs your data, it says so — or it doesn’t ship.
Zero dependencies
Pure PHP, plain Node, native APIs. Fewer moving parts means fewer supply-chain surprises and code you can still read in two years.
Ship, then sharpen
Small releases, fast iteration, real users. Twelve public repositories and a steady stream of tools people actually run daily.
Dark, fast, bilingual
Interfaces that respect attention: dark by default, keyboard-first, English and Persian side by side, smart routing for the region you’re in.
How a request gets out — and stays yours.
The same three-stage shape behind dewberry and mulberry: decide locally, disguise on the wire, forget everything afterwards.
route
Smart Iran routing splits domestic traffic from the rest before a single packet leaves the machine. Rules live in a local routing.json — no cloud policy server.
disguise
The native Shade engine rewrites the TLS handshake (SNI spoofing), or hands the stream to an Xray/V2Ray core in Proxy or TUN mode when the whole device needs coverage.
forget
Latency tests pick the fastest exit, the live dashboard shows throughput in real time, and nothing is persisted: logs = 0, telemetry = off.
What happens when you knock on 10ck.
Six tools. One obsession with clean internals.
Everything below is public on GitHub — free for noncommercial use, readable end to end.
mulberry
A modern, minimal Xray client for Windows: subscription management, latency testing, fastest-server selection, Proxy & TUN modes, smart Iran routing and a live traffic dashboard.
dewberry
Unified secure tunneling: native SNI spoofing via the in-house Shade engine plus Xray/V2Ray, Proxy and TUN modes, all in one dark client.
huckleberry
Record a web form once, then let an AI answer it in a loop. Privacy-first browser extension with 10 AI providers, a native sidebar and automatic stall recovery.
morghie
A chicken-farming mafia economy game for Telegram groups — farms, duels, casino, lottery, heists and 8 genetic tiers. Pure PHP, zero dependencies.
anonchat
Privacy-first anonymous group chat bot. Two runtimes (Node.js + PHP), zero dependencies, and no message content ever written to disk.
GNOME-Config
A custom GNOME rice — the desktop everything else gets built on. Dotfiles, theming and the keyboard-first workflow behind the tools above.
The vault takes four characters.
You already know the code — it’s written at the top of this page. Type it in and the lock opens.
- Signed, stripped, single-artifact builds. No installers phoning home, no background updaters you didn’t ask for.
- Secrets stay local. Configs and subscriptions are encrypted at rest and never leave the machine that made them.
- Open by design, closed by default. Read the source, build it yourself, then decide what to trust.
- Bilingual by birth. Every interface ships English and Persian, right down to the error messages.
One developer behind the padlock.
Mercad Shahidi
“Building things, breaking things, understanding things.” That line sits on the GitHub profile and it’s the whole method: reverse-engineer the protocol, rebuild it smaller, then keep only what survives real use.
- Systems & networking — tunnels, proxies, SNI-level trickery and routing that holds up on restrictive networks.
- AI & automation — agents that handle the boring parts of the web, ten providers behind one sidebar.
- Bots & game economies — Telegram worlds with genetics, heists and lotteries, in dependency-free PHP.
- Developer experience — dark, bilingual, keyboard-first interfaces and a GNOME rice to match.
First commit
The @sadult account opens. Linux, dotfiles and a lot of reading other people’s source.
morghie & anonchat
Telegram as a playground: a full chicken-mafia economy with 8 genetic tiers, and an anonymous chat bot that stores exactly nothing. Pure PHP, zero dependencies.
huckleberry
Record a form once, let an AI finish it a hundred times. Ten providers, a native sidebar and stall recovery for when models go quiet.
dewberry & mulberry
The Shade engine for native SNI spoofing, then a full Xray client with latency tests, TUN mode and a live traffic dashboard.
10ck
One roof for all of it: a name that reads as a number, and a promise that stays the same in both alphabets.
Why “10ck” and not “lock”?
Is everything really dependency-free?
What does “privacy-first” mean in practice?
Can I use these commercially?
Got something that should stay private?
Tunnels, bots, browser agents, internal tools — or an idea that needs a paranoid second opinion. The inbox is open.