Application security engineer. I break software the way attackers would, then help build it back stronger. Pentesting, secure code review, and threat modeling from the dark, glowing edge of the marsh.
.-~~~~~~~-.
.~ o o o o ~.
( o o o o o o )
(o o o o o o o o)
( o o o o o o )
'~-._______.-~'
| : : |
| : : |
| : : |
.-| : : |-.
(___________) Field Report
I’m an application security engineer who treats every codebase like an ecosystem. Most bugs aren’t loud; they grow quietly in the dark, in the gaps between trust boundaries. My job is to go in with a light and find them before anyone else does.
I work across the whole lifecycle: adversarial testing of web, mobile, and API surfaces, line-level secure code review, and threat models that bake security into the design instead of bolting it on. I like clear write-ups, reproducible findings, and fixes that actually hold.
Off the clock you’ll find me in CTFs, poking at auth flows, building 3D toys, and collecting good security writing.
Capabilities
Penetration Testing
Adversarial assessment of web, mobile, and API surfaces. I find the path attackers would take, then document exactly how to close it.
Secure Code Review
Line-level audit of source for injection, broken auth, and logic flaws. Manual depth, backed by static analysis where it earns its place.
Threat Modeling
Mapping trust boundaries and abuse cases early, so security is designed into the system rather than bolted on after launch.
App Hardening
Turning findings into durable fixes: auth, headers, input handling, and defense-in-depth that survives the next refactor.
Vuln Research
Digging into how things actually break, for sport and for signal. Disclosure handled responsibly, every time.
Selected Work
.-~~~-. ( o o o ) ( o o o o ) '-._____.-' | | | (_____)
Attack-surface mapper that renders subdomain and service exposure as a living, glowing fungal network.
.-~~~~~-.
( o o o o )
(o o o o o o)
'~-.___.-~'
| : |
| : |
(_____) Notes and proof-of-concepts from teardowns of common authentication flows across modern SaaS.
.-. .~o~. ( o o ) ( o o o ) '-._.-' |:| |:| (___)
Write-ups and tooling from CTF seasons. Web and pwn focused, with reproducible solve paths.
Off the Clock
Lenny's Podcast
World-class product and growth leaders, broken down into tactics you can actually ship.
404 Media
Journalist-run dispatches from the internet’s weird, broken underbelly: hacking, privacy, surveillance, AI.