HANK ELSNER/FOR EDEN

A proposal, in writing

Eden — let's put your projects on chain, and on the web, properly.

I'm Hank. You've got the projects. What you don't have yet is the machine around them — the live site, the mint pages, the wallet tools, the dashboards — built so the money side can't go wrong.

That's what I do. I already run this exact stack in production: a live non-custodial Dogecoin wallet, a mint-as-a-service that fulfills real paid orders on its own, and a fully built 250-piece Doginal collection — all on infrastructure I operate end to end.

Here's what I believe before anything else: crypto projects don't usually die from bad ideas. They die from sloppy engineering around keys and spend-paths — a seed that touched a server, a fee calculation that ate an NFT, a signing bug nobody caught until money moved wrong. So everything I build starts from the threat model and works backward, and the rule is simple: when the system isn't sure, it stops. It never guesses with your money.

The deal is just as simple: you bring the project, you keep the keys, I build the machine around it. Every security claim on this page is running live right now — you can click through and check.

Let's talk See it running live

Non-custodialYour keys never touch my servers — by architecture, not by promise.

Fail-closedAnything the system can't prove safe, it refuses to spend.

You own the repoOne clone reproduces your whole project, with or without me.

What you get

A complete, live web presence for your crypto projects — not a mockup, not a template. Concretely:

A public portal — your project's home on the web, with automatic HTTPS on every page.
Mint pages — a real order-and-inscribe flow like the one fulfilling paid orders on GOD SAVES today, with clear published pricing and status your buyers can follow.
Wallet tools — non-custodial by design: signing happens entirely in your users' browsers, never on the server. The details are under Security.
Collection pages — a browser for every item, rarity pages, and technicals, with artwork anyone can verify byte-for-byte before minting.
Dashboards and an operator console — order status, wallet views, and admin controls behind a real login, separate from anything the public sees.
Your own repository — the whole project, art generator to site to marketplace exports, in one git repo that belongs to you. A single clone reproduces everything.

Everything above exists and runs today under my own projects. Building yours means pointing a proven machine at your work — not inventing one from scratch.

Security is the product

Crypto sites fail in ugly, irreversible ways, so I don't treat security as a feature list — it's the architecture. I'll walk through it the way I'd want it walked through if it were my money on the line. These aren't aspirations; each one is how the live system works today.

User keys never leave the browser

Fully non-custodial: private keys and seed phrases are generated and used for signing entirely inside the user's browser. The server never sees a seed — it only reads chain state and relays already-signed transactions.
Deterministic signing: signatures use deterministic ECDSA per RFC 6979 with low-S normalization and strict DER encoding. There is no random number generator at signing time, which eliminates the classic nonce-reuse failure that has leaked private keys from other wallets.
The signing core proves itself before it's trusted: built-in known-answer self-tests run over its hash, curve, and signature primitives, and nothing signs until they pass.
Where server-side signing is unavoidable (minting), it's isolated and offline: a separate step with no network access — it can't broadcast — and the key is wiped from memory on both the success path and the error path. Broadcasting lives in separately gated code.

Spends fail closed

Every coin is classified before it's spent — plain DOGE versus inscription, token, or dune. Anything unproven is treated as an asset and held back. An NFT or token can never be accidentally burned as a network fee.
If the asset indexer is unreachable, the system halts. It refuses to build a transaction rather than risk spending something it can't classify. No guessing, ever.
Money math is integer-only — base units, never floating point — so on-chain amounts are exact by construction.

One engine, one proven path

There is exactly one money engine. All key handling, signing, gating, and broadcasting live in a single shared codebase that every project calls out to. Money code is never copy-pasted into project repos — so a fix or a review in one place covers every product.
The identical signing library file runs in the browser wallet and in the server-side mint engine. One implementation, never forked. Every signature the platform has ever produced went through the same code path — one that proves itself with built-in known-answer self-tests before it is allowed to sign.

Nothing goes live by accident

The system never enters broadcast mode without a deliberate operator act. The broadcast path is fail-closed — any error reads as off — and a fresh deploy always comes up in dry-run. Going live is a separate, intentional human step.
Privileged operations sit behind an operator gate on top of normal login. Admin actions that touch order state are constrained edits that can never touch money or keys; recovery actions that move money are additionally kill-switch-gated. End users can't reach any of it, and every admin endpoint is re-checked server-side.

Access is denied by default

One central identity service for every app — a single login and one server-enforced authorization gate, instead of each app improvising its own auth. A session is a single HttpOnly, Secure, server-signed cookie with an expiry.
New-device verification is on by default: an unrecognized device can't get a session until it's explicitly approved out-of-band by the operator.
Access is per-app, per-user, opt-in, and checked server-side on every request. Nothing is granted by default, and hiding a link is never treated as security.
Secrets live in an encrypted vault and are injected only server-side at the proxy — the browser never receives a privileged key, and secrets are referenced by name, never written into application code.

Built for the chain's real sharp edges

The engine is designed for a chain with no replace-by-fee — it assumes a stuck transaction can't be fee-bumped and plans around it with child-pays-for-parent and hold-and-wait strategies instead.
It distinguishes "wait" from "fail": an unconfirmed change output pauses an order and retries later instead of marking it dead — a redesign that eliminated an entire class of indexer-lag race conditions.
Once-only assets are protected so the same item can never be inscribed twice.

Proven live, not proposed

None of this is a pitch deck. These are public, running products on my infrastructure, all built on the one shared engine. Open them right now and kick the tires:

Live

GOD SAVES

godsaves.hankelsner.tech

The complete King James Bible on Dogecoin: all 31,102 verses across 66 books, each verse a one-of-one work of art, mintable exactly once as a Doginal inscription. It's a live mint-as-a-service — real paid orders fulfilled autonomously through the engine, with a transparent flat fee of 1 DOGE per verse published right on the site. Collection browser, inscribe flow, technicals, and project notes are all public.

Live

Doge Wallet

doge.hankelsner.tech

A non-custodial Dogecoin wallet supporting DOGE, DRC-20 tokens, and Doginal NFTs. Keys and signing stay in your browser; the server never sees a seed. Every spend goes through the fail-closed coin classification described above.

Live

BLUE COLLAR

bluecollar.hankelsner.tech

A fully built, ready-to-inscribe 250-piece Doginal challenge-coin collection honoring the 25 skilled trades — ten coins per trade, exactly one 24K Gold one-of-one each. Every coin's traits are written into the inscription payload itself — the exact bytes served by the public API are the bytes that get inscribed — with public rarity and technicals pages.

The operator console

crypto.hankelsner.tech

Go ahead and try it: you'll hit a login. That's the point — product pages stay public, operator surfaces stay locked.

And under those sites sits the same platform that runs dozens of my other live production apps — inventory, safety, time clock, family finance — with web serving, identity, mail, git hosting, and secrets all on infrastructure I operate, under one roof. The pattern gets proven every day.

How we'd work

STEP 1

Discovery

We sit down and get your project on paper — the assets, the audience, the mechanics, the pricing, what your buyers should see. I work out the threat model before I scaffold anything, and I ask the questions now so I don't have to interrupt you later. You get a plain-spoken plan of what gets built and in what order.

STEP 2

Build

Your project starts life as its own independent git repository — generator, site, styles, project memory, and exports all in one place. The money side isn't rebuilt for you; your project calls out to the one shared, self-tested engine, so you inherit every safeguard on this page from day one.

STEP 3

Iterate

You look at live pages, not sketches, and we tune until it's right. Ship, watch, refine.

A few standing rules of the shop, in writing:

Root cause, not patches. When something breaks, I find out why, fix the why, and record it. Code ships tested. Data integrity is treated as paramount.
Decisions are on the record. Every project keeps an append-only, dated decision log inside its repo. Decisions get superseded, never silently rewritten — so a later change can never quietly undo a considered security choice, and the same failure is never learned twice.
Numbers you'll act on get adversarially verified. Cross-checked two independent ways, with the checks themselves tested by planting the exact defect to prove they fire. If a number moves, I correct the record explicitly.
Nothing gets lost. Code and project memory are version-controlled with automated sync that commits and pushes to private mirrors every five minutes — any machine can pick up exactly where another left off.
It runs itself. Every backend is supervised and restarts itself if it dies. The mint pipeline has an hourly watchdog that self-heals deterministically — it only auto-resumes orders whose failure matches a known-remediable pattern and whose funds are confirmed on-chain, with a hard retry cap so it can never loop forever. Nothing automated ever spends outside the rules the operator deliberately switched on.
Smart features are strictly opt-in. They ship dark, activate per user with the user's own key, and are never enabled by default.

You keep everything

This is the part I want you to hold me to, because it's where a lot of crypto arrangements go wrong.

Your keys. Non-custodial by architecture, not by promise. Your users' keys and seeds are generated and used in their browsers — my servers never see their key material. The only server-side key is the project's own isolated, gated mint wallet described under Security.
Your repo. Your project is a self-contained git repository — generator, site, styles, memory, exports. Clone it and you can reproduce, rebuild, restore, or re-submit the whole collection on any machine, with or without me. If you ever want to walk away, you walk away whole.
Your art, verifiable forever. Collection art is fully deterministic — no randomness anywhere — so the same item yields byte-identical artwork on any machine, forever. The public API serves the exact bytes that get inscribed, so anyone can verify an item before minting it.
Your metadata, on chain. Item attributes ride inside the inscribed artwork itself, and one source of truth feeds both the on-chain data and the marketplace manifest. The chain is authoritative; the manifest is derived — they cannot drift apart.
Your rarity, guaranteed. Rarity is enforced by invariant-checked quotas, not dice rolls. Exact supplies per trait are fixed, and the generator refuses to run at all if the quotas stop summing to the collection size. The numbers you publish cannot silently drift.

I build the machine. The project — keys, code, art, data — is yours, provably, the whole way through. I want you to stay because the work is good — not because leaving is hard.

Let's talk

If this sounds right, reach me directly — no forms, no funnel. I'll give you straight answers about what's easy, what's hard, and what I'd do first.

hank@hankelsner.tech

+1 (650) 649-4265

Bring the project. Poke at the live sites first if you want — godsaves, doge, bluecollar — everything I've claimed here is up and checkable. Then call me and let's build yours.

— Hank