2:47 AM: Someone Tried to Open a File on My Laptop. Here's the Log I Pulled the Next Morning.

I wasn't going to write a normal launch post.

You know the format. Every "I built X" post on this site follows the same skeleton: Hi devs 👋 → here's my app → here's a bullet list of features → here's a GitHub link → please star ⭐. I've read fifty of them this month. I was going to write the fifty-first, and then I looked at my own notification panel and realized I already had a better story sitting in it than anything I could write from scratch.

So instead of a feature list, here's a log.

Exhibit A — the notification panel, unedited

This is a real screenshot of the in-app Security Notification Panel from a test machine, the morning after I left a "decoy" vault entry open overnight just to see what would happen if I forgot to lock down before bed (I did not forget on purpose, my testing discipline is not that good):

[02:47:12] FILE GUARD — access denied: "personal_ids.txt" (unauthorized read attempt)
[02:47:12] INTRUDER OPS — photo captured (attempt #1)
[02:47:19] FILE GUARD — access denied: "personal_ids.txt" (unauthorized read attempt)
[02:47:31] VAULT — wrong master password (attempt #2) — warning issued
[02:47:44] VAULT — wrong master password (attempt #3) — warning issued
[02:47:58] VAULT — wrong master password (attempt #4) — 10-hour lockout engaged
[02:47:58] INTRUDER OPS — 10s video captured (escalation)
[02:47:59] INTRUDER OPS — alarm triggered

Eight lines. Nobody wrote a report, nobody clicked a "generate case file" button, nothing was sent to a server anywhere. The app just... did its job, locally, and left a trail I could read with coffee in hand.

That log is ATLOCK. Let me back up and explain what actually produced each line, because the interesting part isn't the drama, it's the mechanics underneath it.

Line 1–2: how "access denied" actually gets enforced

Most "file lock" apps in the wild just hide the file or rename the extension. Curious kid, snooping coworker, or literally anyone who checks "show hidden files" gets right in. That always bugged me, so File Guard in ATLOCK doesn't hide anything — it rewrites the file's NTFS Discretionary Access Control List directly:

sd = win32security.GetFileSecurity(path, win32security.DACL_SECURITY_INFORMATION)
dacl = win32security.ACL()
everyone, _, _ = win32security.LookupAccountName("", "Everyone")
dacl.AddAccessDeniedAce(win32security.ACL_REVISION, con.FILE_ALL_ACCESS, everyone)

system_sid, _, _ = win32security.LookupAccountName("", "SYSTEM")
dacl.AddAccessDeniedAce(
    win32security.ACL_REVISION,
    con.FILE_GENERIC_READ | con.FILE_GENERIC_WRITE, system_sid)

sd.SetSecurityDescriptorDacl(True, dacl, False)
win32security.SetFileSecurity(path, win32security.DACL_SECURITY_INFORMATION, sd)

That's Windows' own security subsystem being told, at the OS level: deny Everyone, deny SYSTEM. The file isn't hidden. It's sitting right there in the folder, visible, named exactly what it was named, and the OS itself refuses the read. There's no "show hidden files" checkbox that fixes that.

Line 2–3: the part nobody expects from a file-locker

Here's the thing I actually wanted to build, and the reason ATLOCK exists at all: a locked file that just silently says "Access Denied" doesn't tell you anything happened. So every denied attempt against a Guarded file or a Vault unlock routes through one orchestrator:

class IntruderOps:
    """
    Single entry point: given a context + level, fires camera / video / sound /
    masked notification — consistently for File Guard & Vault.
    """

First wrong attempt → photo, silently, from whatever camera is attached. Escalate to attempt 3 or 4 → 10-second video plus an audible alarm. Every one of those events also gets written to the Notification Panel, timestamped, and every password attempt gets masked before it's ever logged — so even ATLOCK's own log file never holds a plaintext password, not even a wrong one.

Line 4–7: the vault, and why the math matters more than the marketing

The Vault is where people were going to put UPI PINs and bank details, so "AES encryption" as a marketing phrase wasn't good enough for me, I wanted to know I could defend the actual numbers if someone asked. So:

• Vault contents: Fernet (AES-128-CBC + HMAC), authenticated encryption, not just "encrypted-looking"
• Master password: PBKDF2-HMAC-SHA256, 200,000 iterations, random salt per install
• 3 wrong attempts: warning. 4th wrong attempt: 10-hour hard lockout on the entire app — not just the vault tab, the whole thing

def derive_fernet_key(password: str, salt: bytes) -> bytes:
    kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32,
                      salt=salt, iterations=PBKDF2_ITERATIONS)
    return base64.urlsafe_b64encode(kdf.derive(password.encode()))

200k iterations means a brute-force script isn't casually trying thousands of guesses a second against your vault, it's trying a few dozen. That's the difference between "encrypted" as a checkbox and "encrypted" as something that actually costs an attacker time.

Okay but who actually built this

One person. Me. Akhouri Anmol Kumar, solo developer, India, Akhouri Systems — which is currently a company of exactly one, working late, annoyed at every "lock app" on the market that turns out to be a Tkinter password box with zero enforcement behind it.

ATLOCK v4 is a full rewrite of the vault layer specifically because v3's "encryption" was closer to obfuscation than cryptography, and I wasn't going to ship that under the word "secure" once I actually understood the difference. That's also why this post has code in it instead of just adjectives — I'd rather you read the DACL call and the KDF iteration count yourself than take my word for "military-grade" anything.

What's actually in v4.0

Single portable .exe. No installer, no account, no telemetry, no internet connection required to run any of it — the whole point was that your data doesn't need to leave your machine to be protected.

Try it, break it, tell me

I'm not going to end this with "unbreakable" or "no one can get past it," because I actually respect this audience too much to write a line I can't defend line-by-line the way I just defended the DACL call and the KDF count above. What I will say: every claim above is backed by code you can go read the logic for, not a paragraph of adjectives.

⬇️ Download ATLOCK v4.0 — Windows 10+, portable, no install
⭐ Star the repo if the DACL trick above was new to you, that's exactly the reaction I built this post for
🐛 Open an issue if you find a rough edge, I'm one person and I will actually read it

Drop a comment with the worst "security app" you've ever been burned by, I want to know I'm not the only one who got tired of glorified password boxes.