Independent software & security · Tokyo
Small software, carefully synthesized — and quietly kept safe.
I’m Totooria Helmold, an independent developer. The atelier is where I build small, dependable tools, take systems apart to see how they fail, and write down what I learn along the way.
Currently synthesizing code
Welcome to Atelier Arland! I make small software here — and then I try my very best to break it.
Chapter I · The journal
Six columns, one atelier.
Every entry in the journal is filed under one of six columns — half about building small software, half about keeping it safe. Pick the shelf that matches your curiosity.
-
Indie development
Synthesis Log
Build notes from small products: scoping, architecture, shipping, and the parts that broke on the way there.
BuildingOpen → -
Security research
Field Reports
Vulnerability analysis, attack-surface walkthroughs, and write-ups from authorized testing and disclosed issues.
BreakingOpen → -
Defensive engineering
Wards & Seals
Hardening, secure defaults, threat models, and the unglamorous controls that actually hold under pressure.
ProtectingOpen → -
CTF write-ups
Quest Log
Capture-the-flag challenges and exploit puzzles, solved step by step — dead ends and wrong turns included.
PuzzlingOpen → -
Tools & infrastructure
Recipe Book
Reusable recipes: deployment, scripts, configuration, and command-line know-how worth keeping close.
PractisingOpen → -
Studio & interface
Atelier Notes
Letters from the workbench: releases, interface craft, and honest notes on working independently.
ReflectingOpen →
Only interested in one shelf? Every column has its own Atom feed at /blog/column/<name>/feed.xml.
Chapter II · Fresh from the cauldron
Recent entries.
The newest writing in the journal, straight from the workbench.
- Name
- Totooria Helmold
- Class
- Alchemist · Software & Security
- Guild
- Atelier Arland
- Base
- Tokyo, Japan
Chapter III · The alchemist
Hello — I’m Totori.
I work alone, on purpose. Independent development means owning every layer, from the first sketch of an interface to the reverse proxy in front of it — so I care a lot about the parts that are easy to skip.
The other half of the work is security: reading code adversarially, testing my own assumptions, and writing up what I find so the next person can skip a dead end.
- I
Small, complete promises
Ship one workflow that works end to end before adding a second.
- II
Secure by default
Escape output, deny by default, and make convenience the opt-in.
- III
Leave a paper trail
Releases should be observable, repeatable, and reversible — and written down.
Chapter IV · Request board
Letters are always welcome.
Questions about an entry, a correction, or a security issue in something I’ve built — pin a request to the board and I’ll get back to you.
- Questions & correctionsAbout anything in the journal.
- Security reportsFound an issue in something I made? Tell me privately first.
- Ideas for the cauldronTopics you’d like to see written up.