Inspiration
In most companies, sending a large payment can be incredibly risky when only a username and password stand in the way. One shared login or compromised account can lead to a costly transfer that's hard to undo. Approving a six-figure payment often takes just one click.
We wanted every high-value payment to be approved on purpose, by the right person, with something you can hold, and not rely on the internet for.
We drew inspiration from the Poneglyphs in One Piece: ancient stone tablets that guard secrets only the right reader can unlock. Runevault is a security key disguised as one of those relics. Every important transfer must be sealed by hand before it sets sail.
What it does
📜 Physical Sign-Off: The approver enters a glyph sequence on the Runevault tablet. It creates a unique signature for that exact transfer, with lights confirming each step. 🔐 Verification: The backend checks that the signature is genuine, matches the transfer, comes from the registered tablet, and has never been used before. 🧭 AI Risk Review: Gemini turns the glyphs into ancient lore and gives a risk score with a plain-English explanation. Gemini advises while our backend rules make the final call. If anything looks off, or Gemini fails, the transfer is blocked. ⚓ Secure Transfers: Only after every check passes does Runevault send the transfer through Capital One's Nessie API and show a receipt. 👑 Role-Based Access: Employees can create requests, Department Heads approve up to $10,000, the CFO up to $250,000, and the CEO any amount. 🗺️ Live Captain's Log: The dashboard updates in real time with status, risk gauges, lore, receipts, and an approvals vs. blocks chart.
How we built it
Our dashboard uses Angular and TypeScript, styled with weathered stone, parchment, and ocean tones. It holds a primarily navy and gold color palette.
The physical key is a Raspberry Pi Pico 2 running MicroPython. It signs each transfer with HMAC-SHA256 and saves a counter to block replays. A bridge sends approvals over USB to our backend.
Our Java and Spring Boot backend runs every transfer through one pipeline:
Verify the signature, device, counter, and rate limits.
Send only transfer metadata to Gemini, which returns schema-enforced JSON.
Apply our rules: confidence of at least 0.8 and risk of at most 30.
Call Nessie and build the receipt.
Push each step live over Spring WebSockets and log it in Tiger Data (TimescaleDB).
Auth0 handles login, MFA, and roles. Everything runs in Docker on a Vultr server behind Caddy, at our GoDaddy Registry domain, sailthedeal.fishing.
Challenges we ran into
The key and backend had to produce identical signatures down to the byte. Tiny formatting differences broke valid approvals until we wrote a shared signing spec.
We started with two approval flows and merged them into one, so no transfer can skip a check.
We had to keep Gemini helpful without letting it make security decisions. Deploying in less than basically 12 hours was tough, as DNS, HTTPS, Auth0 redirects, and WebSockets all had to line up on a brand-new domain.
Accomplishments that we're proud of
Runevault was able to work*end to end*, even though we had our fears about being unable to integrate the hardware and software together. A press on one of the buttons travels over USB, gets verified, reviewed by Gemini, sent through Nessie, and shown live on the dashboard.
We covered most of the edge cases, allowing fails in a safe manner such as transfers being blocked if Gemini does not respond, a time limit set for entering your generated glyph sequence, etc. Bad signatures, replays, high risk, and AI outages all are addressed and stopped, never leading to any accidental payments.
Our biggest accomplishment was turning payment approval into something that feels like uncovering an ancient artifact, and for trying something new that was not purely software! We were really glad to see that this could be an amazing possibility for keeping authentication safer if it's physical and does not rely on WiFi and other factors.
What we learned
Hardware Security: Signatures, counters, and replay protection, and how strict byte-level protocols are. Responsible AI: Getting reliable JSON from Gemini, and letting AI advise rather than decide. Identity & Access: Building role-based access with Auth0 and enforcing it on the backend. Time-Series Data: Using TimescaleDB hypertables and aggregates for live charts. Cloud Deployment: Going from localhost to a live HTTPS domain on Vultr.
What's next for Runevault
If we were to continue expanding on Runevault, our next steps include: Multi-Step Approvals: Big transfers that need both a Department Head and the CFO. Our project is currently designed a way that makes it possible for scalability and for real multi-step pipelines that might happen in companies. More Custom Glyphs: We would have liked to incorporate more combinations than the 3 glyphs we have as of now, and to incorporate more potential stories that Gemini could tell. Banking Integrations: Bringing the physical seal to real corporate banking platforms. Hardware Prototype: Designing the Runevault token to be compact and likely lightweight so it would not be an inconvenience to bring it around.
We had so much fun building this project! #mlhacks.
