Developer Exploitation — Victoria, Australia

I built three commercial platforms for an Australian company. They kept the work, refused to pay, and the government said it couldn't help because I'm not Australian.

Published by R.N. Liyon · VertexElite Security Research · Sri Lanka · First disclosed: July 2026 · Updated: November 2026

Key Facts at a Glance

What Happened

Between August 2025 and July 2026, I designed and built three full commercial software platforms from scratch for a client based in Victoria, Australia. These are not prototypes — they are production-grade systems, currently live and generating revenue:

Crittiks
Business repair management platform. Full-stack, deployed, live at crittiks.com
Selling at $49.95–$179.95/month
EarthyTabs
Multi-portal business operations system. Five-portal architecture
Live — earthytabs.com
6SILO
Business productivity platform. Live — 6silo.com
Live — 6silo.com

I was not paid. When I raised the issue, the client cut off my access, removed my name from the platforms, and continued operating them commercially. He then filed a fraudulent chargeback on a payment he had already received the work for.

The platforms remain live today, charging end users, built entirely on my unpaid labour.

The Entities Involved

The client operates through a network of four Victorian-registered companies. All are verifiable through ASIC's public register:

ACN 654 097 837
CRITTIKS GLOBAL PTY LTD
Formerly: Real Dating App Global Pty Ltd. Renamed 8 August 2024. Active.
ACN 654 097 784
CRITTIKS GROUP PTY LTD
ABN displayed on crittiks.com. Registered 1 December 2021. Active.
ACN 154 054 172
SILO GROUP PTY LTD
Operating entity for 6SILO platform. Victorian-registered.
ACN 653 112 335
HETT GROUP HOLDINGS PTY LTD
Controlling entity. Suite 073, 44 Lakeview Drive, Scoresby VIC 3179.

Director and controller: Don Lalin Devinda Hettiaratchie. His public profiles describe him as CVO of 6SILO and a business leader in the Victorian small business community.

The Evidence

This is not a "he said/she said" dispute. The evidence is technical, verifiable, and independently confirmable:

🔐
Cryptographic authorship proof
Git commit history, DKIM-authenticated emails, and infrastructure deployment logs establish my authorship of the codebase beyond dispute. These records predate any claim of independent development.
🏛️
ASIC public records
All four company registrations verified against ASIC. ACN numbers, registration dates, and addresses are public record. The client's companies are unambiguously Victorian-registered.
🌐
Infrastructure forensics
DNS records, server fingerprints, and deployment metadata confirm the platforms continue to operate on infrastructure I originally built and configured. The architecture is identifiable and documented.
💳
Fraudulent chargeback documentation
Transaction records and communications document the chargeback filed on a legitimate payment for work already delivered. The timing and sequence establish fraudulent intent.
📸
Wayback Machine archives
Timestamped archives at the Internet Archive preserve crittiks.com, the pricing page, and 6silo.com as of November 2026 — confirming active commercial operation of the platforms.

The full evidence repository — 40+ indexed exhibits — is publicly accessible at notice.vertexelite.org.

The Institutional Failure: How the System Protected the Wrong Party

In July 2026, I filed with the Victorian Small Business Commission (VSBC) — the government body established to handle exactly this kind of commercial dispute. The file was assigned reference CS0046117.

Four months later, with no progress, the VSBC proposed to close my file. Their reason: I do not hold an Australian Business Number (ABN) because I am based in Sri Lanka.

I challenged this. I pointed out that every respondent is Victorian-registered, that the VSBC's own published guidance says it handles disputes "between a Victorian small business and another business" — and that the Victorian small business in this case is on the other side of the table.

The Acting Victorian Small Business Commissioner, Ylva Carosone, replied on 30 October 2026 with the official final decision. It contained a critical admission:

"For clarity, the proposed closure of the file should not be understood as a determination that the Small Business Commission Act 2017 contains a specific requirement that every applicant hold an Australian Business Number. Rather, the issue is whether it is appropriate for the VSBC to accept and progress an application by an overseas business under its general commercial dispute resolution function, having regard to the purpose and intended scope of the VSBC's dispute resolution services." — Ylva Carosone, Acting Victorian Small Business Commissioner, 30 October 2026

What the Commissioner just admitted

The Small Business Commission Act 2017 contains no law requiring an applicant to hold an ABN. The Commissioner confirmed this in writing. The closure was a discretionary administrative decision — a policy choice — not a legal requirement. A government body chose not to help. There is no Act of Parliament behind it.

The Commissioner also suggested I "approach CRITTIKS GLOBAL PTY LTD directly and invite it to submit an application" — asking the alleged victim of fraud to request that the alleged perpetrator file a complaint on their behalf.

I have now escalated to the Victorian Ombudsman (complaint C/26/20584). The Ombudsman is currently reviewing whether the VSBC's discretionary decision to close my file was lawful and reasonable. I have also filed updates with the ACCC and ASIC.

Why This Matters Beyond My Case

This is not an isolated incident. The pattern is systematic and exploitable:

Victorian companies can engage overseas contractors, withhold payment, appropriate their work, and face zero accountability through any Victorian government dispute resolution mechanism — because the contractor doesn't hold an ABN and therefore cannot access the VSBC.

The ACCC, VSBC, and other Australian consumer and business protection bodies are structurally inaccessible to overseas parties — regardless of whether the entity that harmed them is Australian-registered, Australian-domiciled, and operating on Australian soil.

If you are a developer, designer, or service provider outside Australia working for Australian clients:

Get everything in writing. Keep all Git history. Record all communications. The legal route is VCAT — file directly, serve on the Australian company's registered address, no ABN required.

Timeline

August 2025 – July 2026
Platforms built and deployed
Crittiks, EarthyTabs, and 6SILO designed, built, and deployed to production. Platforms go live.
Mid-2026
Non-payment and infrastructure seizure
Client withholds final payment, removes developer access, removes attribution, files fraudulent chargeback. Platforms continue operating commercially.
July 2026
VSBC application filed (CS0046117)
Application lodged with the Victorian Small Business Commission for unpaid remuneration of approximately AUD $15,000–$20,000. VSBC acknowledges receipt.
26 October 2026
VSBC proposes to close file — "no ABN"
After four months, VSBC Dispute Resolution Officer states they cannot assist an overseas business and proposes to close the file by end of week.
26 October 2026
Formal challenge + multi-agency escalation
Formal objection filed to VSBC Commissioner. Simultaneous complaints filed with Victorian Ombudsman, ACCC, ASIC, and ASBFEO.
30 October 2026
Acting Commissioner closes file — admits no legislative basis
Ylva Carosone (Acting Commissioner) issues final decision closing CS0046117. Critically, admits in writing that the Small Business Commission Act 2017 contains no ABN requirement. Closure is a discretionary policy decision.
3–5 November 2026
Victorian Ombudsman review activated
Victorian Ombudsman (C/26/20584) requests all documentation. Full package — 4 documents including Commissioner's written admission — provided 5 November. Review ongoing.
November 2026
Public disclosure
With institutional channels nearing exhaustion and no resolution after four months, public disclosure issued. Full evidence repository available at notice.vertexelite.org.

Technical Proof: The Engine Is Identical

The claim "we built a new platform with a different UI" can be tested technically. API route paths are defined in source code and do not change during a UI redesign. If the same routes exist, the same codebase is running.

The original source code — authored by R.N. Liyon, with Git timestamps predating any claimed independent development — defines 200+ unique API routes. On 13 November 2026, every one of the following routes was probed against the live app at os.crittiks.com. A 401 response means the route exists and requires authentication. A 404 would mean it does not exist.

32 / 32 Routes Confirmed — os.crittiks.com — 13 Nov 2026
API Route HTTP Status Verdict
/api/shadon/chat 401 EXISTS ★ UNIQUE NAME
/api/shadon/conversations 401 EXISTS ★ UNIQUE NAME
/api/ai-workflow 401 EXISTS
/api/ai/consensus 401 EXISTS
/api/team-chat/channels 401 EXISTS
/api/time-tracking/clock/status 401 EXISTS
/api/offline-sync 401 EXISTS
/api/agreements 401 EXISTS
/api/agreement-signing 401 EXISTS
/api/cron/daily-digest 401 EXISTS
/api/daily-summary 401 EXISTS
/api/utilization 401 EXISTS
/api/system/pm2 401 EXISTS
/api/saved-views 401 EXISTS
/api/sops 401 EXISTS
/api/workspaces/switch 401 EXISTS
...and 16 more 401 ALL EXIST

Why /api/shadon/ is definitive proof

"Shadon" is the name the original developer gave to the platform's AI assistant. It is not a framework name, not a library name, not an industry term. It is a unique custom identifier chosen by one person. The existence of /api/shadon/chat and /api/shadon/conversations as live API routes in the production system proves this is the same codebase. No independent rewrite would produce this route.

★ The Smoking Gun — Try It Yourself

Run this command right now. You will get 401.

curl -s -o /dev/null -w "%{http_code}" https://os.crittiks.com/api/shadon/chat

"Shadon" is a name the original developer chose for the platform's AI assistant. It is not a framework, not a library, not an industry term. It exists as a 5-file library module (lib/shadon/access-guard.ts, ollama-client.ts, system-prompt.ts, summarize.ts, workspace-data.ts), as a database table (ShadonConversation in Prisma), and as an API route (/api/shadon/chat, /api/shadon/conversations). All three layers exist identically in the original source and in the live production system today.

From the original source file: lib/shadon/access-guard.ts
// Hardcoded email whitelist for stakeholder portal access
// Written by the original developer during development

const SHADON_USERS = new Set([
  'shenikf23@gmail.com',    // Shenik Fernando (CTO)
  'don@6silo.com',           // Don Hett (Director)
  'liyonramesh@gmail.com',   // ← the original developer
  'ashfaq.rnf@gmail.com',    // Ash Ahmed (Co-Founder)
]);

This whitelist was written by the original developer and includes his own email alongside the client's team. The client's team members were granted access through the original developer's code during the development phase. This file exists on the original developer's machine at E:\dev\crittiks\lib\shadon\access-guard.ts with filesystem timestamps predating the dispute.

🔬
Field name in compiled JavaScript
The field isPlatformAdmin — defined in the original Prisma database schema with the comment "True only for actual platform admins, not agency owners" — appears verbatim in the compiled JavaScript bundle at os.crittiks.com/_next/static/chunks/119qaayvomhg8.js. Field names survive compilation. This field name traces directly to the original developer's schema design decisions.
🏥
Health endpoint confirms active deployment
The unauthenticated health check at /api/health returns {"status":"ok","build":"gzWAX6k5JxU4A58VxX9Ou"} — confirming the app is live, deployed, and actively serving users as of 13 November 2026. The error format from protected endpoints ({"error":"unauthenticated"}) matches the original codebase's API error handling pattern.

Anyone can independently verify these routes exist. Open your browser's developer tools, navigate to os.crittiks.com, and check the Network tab — or run curl -s -o /dev/null -w "%{http_code}" https://os.crittiks.com/api/shadon/chat. You will get 401.

Verify Everything Yourself

All claims in this disclosure are backed by documented evidence. The full repository — 40+ indexed exhibits including technical forensics, government correspondence, and ASIC extracts — is publicly accessible.

Contact: liyonramesh@gmail.com · R.N. Liyon, VertexElite Security Research, Sri Lanka
Ombudsman Ref: C/26/20584 · VSBC Ref: CS0046117