Key Facts at a Glance
- Built Crittiks, EarthyTabs, and 6SILO platforms — full production, deployed and live
- Client: Don Lalin Devinda Hettiaratchie, Victoria, Australia — four registered companies
- Amount owed: approximately AUD $15,000–$20,000 — unpaid since mid-2026
- Client kept all platforms, removed my attribution, now charges users $49.95–$179.95/month
- Client also filed a fraudulent chargeback on a legitimate payment
- Victorian Small Business Commission closed my file — admitted no law required them to do so
- Victorian Ombudsman is now reviewing the VSBC's decision
What Happened
Between August 2025 and July 2026, I designed and built three full commercial software platforms from scratch for a client based in Victoria, Australia. These are not prototypes — they are production-grade systems, currently live and generating revenue:
I was not paid. When I raised the issue, the client cut off my access, removed my name from the platforms, and continued operating them commercially. He then filed a fraudulent chargeback on a payment he had already received the work for.
The platforms remain live today, charging end users, built entirely on my unpaid labour.
The Entities Involved
The client operates through a network of four Victorian-registered companies. All are verifiable through ASIC's public register:
Director and controller: Don Lalin Devinda Hettiaratchie. His public profiles describe him as CVO of 6SILO and a business leader in the Victorian small business community.
The Evidence
This is not a "he said/she said" dispute. The evidence is technical, verifiable, and independently confirmable:
The full evidence repository — 40+ indexed exhibits — is publicly accessible at notice.vertexelite.org.
The Institutional Failure: How the System Protected the Wrong Party
In July 2026, I filed with the Victorian Small Business Commission (VSBC) — the government body established to handle exactly this kind of commercial dispute. The file was assigned reference CS0046117.
Four months later, with no progress, the VSBC proposed to close my file. Their reason: I do not hold an Australian Business Number (ABN) because I am based in Sri Lanka.
I challenged this. I pointed out that every respondent is Victorian-registered, that the VSBC's own published guidance says it handles disputes "between a Victorian small business and another business" — and that the Victorian small business in this case is on the other side of the table.
The Acting Victorian Small Business Commissioner, Ylva Carosone, replied on 30 October 2026 with the official final decision. It contained a critical admission:
"For clarity, the proposed closure of the file should not be understood as a determination that the Small Business Commission Act 2017 contains a specific requirement that every applicant hold an Australian Business Number. Rather, the issue is whether it is appropriate for the VSBC to accept and progress an application by an overseas business under its general commercial dispute resolution function, having regard to the purpose and intended scope of the VSBC's dispute resolution services." — Ylva Carosone, Acting Victorian Small Business Commissioner, 30 October 2026
What the Commissioner just admitted
The Small Business Commission Act 2017 contains no law requiring an applicant to hold an ABN. The Commissioner confirmed this in writing. The closure was a discretionary administrative decision — a policy choice — not a legal requirement. A government body chose not to help. There is no Act of Parliament behind it.
The Commissioner also suggested I "approach CRITTIKS GLOBAL PTY LTD directly and invite it to submit an application" — asking the alleged victim of fraud to request that the alleged perpetrator file a complaint on their behalf.
I have now escalated to the Victorian Ombudsman (complaint C/26/20584). The Ombudsman is currently reviewing whether the VSBC's discretionary decision to close my file was lawful and reasonable. I have also filed updates with the ACCC and ASIC.
Why This Matters Beyond My Case
This is not an isolated incident. The pattern is systematic and exploitable:
Victorian companies can engage overseas contractors, withhold payment, appropriate their work, and face zero accountability through any Victorian government dispute resolution mechanism — because the contractor doesn't hold an ABN and therefore cannot access the VSBC.
The ACCC, VSBC, and other Australian consumer and business protection bodies are structurally inaccessible to overseas parties — regardless of whether the entity that harmed them is Australian-registered, Australian-domiciled, and operating on Australian soil.
If you are a developer, designer, or service provider outside Australia working for Australian clients:
- You have no access to Victorian small business dispute resolution, even if your client is fully Victorian-registered
- You have no access to ASBFEO advocacy
- Your only remaining options are VCAT (Victorian Civil and Administrative Tribunal — no foreign representative required) or civil court proceedings
- The ACCC can receive notifications but does not resolve individual disputes
Get everything in writing. Keep all Git history. Record all communications. The legal route is VCAT — file directly, serve on the Australian company's registered address, no ABN required.
Timeline
Technical Proof: The Engine Is Identical
The claim "we built a new platform with a different UI" can be tested technically. API route paths are defined in source code and do not change during a UI redesign. If the same routes exist, the same codebase is running.
The original source code — authored by R.N. Liyon, with Git timestamps predating any claimed independent development — defines 200+ unique API routes. On 13 November 2026, every one of the following routes was probed against the live app at os.crittiks.com. A 401 response means the route exists and requires authentication. A 404 would mean it does not exist.
| API Route | HTTP Status | Verdict |
|---|---|---|
| /api/shadon/chat | 401 | EXISTS ★ UNIQUE NAME |
| /api/shadon/conversations | 401 | EXISTS ★ UNIQUE NAME |
| /api/ai-workflow | 401 | EXISTS |
| /api/ai/consensus | 401 | EXISTS |
| /api/team-chat/channels | 401 | EXISTS |
| /api/time-tracking/clock/status | 401 | EXISTS |
| /api/offline-sync | 401 | EXISTS |
| /api/agreements | 401 | EXISTS |
| /api/agreement-signing | 401 | EXISTS |
| /api/cron/daily-digest | 401 | EXISTS |
| /api/daily-summary | 401 | EXISTS |
| /api/utilization | 401 | EXISTS |
| /api/system/pm2 | 401 | EXISTS |
| /api/saved-views | 401 | EXISTS |
| /api/sops | 401 | EXISTS |
| /api/workspaces/switch | 401 | EXISTS |
| ...and 16 more | 401 | ALL EXIST |
Why /api/shadon/ is definitive proof
"Shadon" is the name the original developer gave to the platform's AI assistant. It is not a framework name, not a library name, not an industry term. It is a unique custom identifier chosen by one person. The existence of /api/shadon/chat and /api/shadon/conversations as live API routes in the production system proves this is the same codebase. No independent rewrite would produce this route.
Run this command right now. You will get 401.
"Shadon" is a name the original developer chose for the platform's AI assistant. It is not a framework, not a library, not an industry term. It exists as a 5-file library module (lib/shadon/access-guard.ts, ollama-client.ts, system-prompt.ts, summarize.ts, workspace-data.ts), as a database table (ShadonConversation in Prisma), and as an API route (/api/shadon/chat, /api/shadon/conversations). All three layers exist identically in the original source and in the live production system today.
// Written by the original developer during development
const SHADON_USERS = new Set([
'[email protected]', // Shenik Fernando (CTO)
'[email protected]', // Don Hett (Director)
'[email protected]', // ← the original developer
'[email protected]', // Ash Ahmed (Co-Founder)
]);
This whitelist was written by the original developer and includes his own email alongside the client's team. The client's team members were granted access through the original developer's code during the development phase. This file exists on the original developer's machine at E:\dev\crittiks\lib\shadon\access-guard.ts with filesystem timestamps predating the dispute.
isPlatformAdmin — defined in the original Prisma database schema with the comment "True only for actual platform admins, not agency owners" — appears verbatim in the compiled JavaScript bundle at os.crittiks.com/_next/static/chunks/119qaayvomhg8.js. Field names survive compilation. This field name traces directly to the original developer's schema design decisions./api/health returns {"status":"ok","build":"gzWAX6k5JxU4A58VxX9Ou"} — confirming the app is live, deployed, and actively serving users as of 13 November 2026. The error format from protected endpoints ({"error":"unauthenticated"}) matches the original codebase's API error handling pattern.Anyone can independently verify these routes exist. Open your browser's developer tools, navigate to os.crittiks.com, and check the Network tab — or run curl -s -o /dev/null -w "%{http_code}" https://os.crittiks.com/api/shadon/chat. You will get 401.
Verify Everything Yourself
All claims in this disclosure are backed by documented evidence. The full repository — 40+ indexed exhibits including technical forensics, government correspondence, and ASIC extracts — is publicly accessible.
Contact: [email protected] · R.N. Liyon, VertexElite Security Research, Sri Lanka
Ombudsman Ref: C/26/20584 · VSBC Ref: CS0046117