Application Security Engineer working across secure software engineering, backend development, cloud security, DevSecOps and automation.
I focus on validating security risks against real code paths, improving engineering controls and turning security analysis into practical changes. My repositories include original projects, experiments, educational material and forks kept for reference.
- Application Security: secure code review, SAST/DAST evidence, vulnerability validation and threat modeling.
- Secure engineering: backend architecture, data handling, authorization boundaries and reliability.
- DevSecOps: CI/CD, security automation, dependency hygiene and supply-chain controls.
- Research and learning: reproducible experiments, benchmarks and security-oriented tooling.
| Project | What it covers | Status |
|---|---|---|
| Satellite | Java libraries for typed dynamic data and policy-controlled handling of sensitive data at application egress boundaries. | Active development |
| Vulnerability Benchmark | Collection for comparing SAST results across languages and studying false positives. | Historical / research |
| Scoop | Python data-collection and ETL experiment with database and analytics components. | Historical / experimental |
| Link Sanitizer | Chrome extension with user-defined rules to strip tracking parameters and optionally suppress the Referer header. | Recently updated |
- Prefer evidence of reachability and exploitability over unvalidated scanner alerts.
- Make security assumptions, trust boundaries and residual risks explicit.
- Keep changes reviewable, testable and proportional to the problem.
- Treat production readiness as a verified property, not a label.
Browse my repositories for public projects and reference forks. A fork does not imply authorship of its upstream code; check each repository's origin and license.
For collaboration or questions, use the relevant repository's issues or discussions, when enabled.