I'm a security engineer with a research first mindset, aiding in securing open source software.

My work focuses on the intersection of software supply chain security, application security, and cloud security.

I focus on:

• Auditing software dependencies, packages, and container images for supply chain risks
• Securing CI/CD pipelines by improving artifact integrity, build trust, and deployment security
• Applying software supply chain security practices including SLSA, SBOM management, zero-trust CI/CD, hardened pipelines, and continuous dependency monitoring

• Software dependency risk assessment: vulnerable packages, malicious dependencies, and dependency confusion
• SBOM generation and analysis for open-source component visibility
• CI/CD pipeline security: build integrity, artifact validation, and secure automation workflows
• Supply chain attack detection: package hijacking, typosquatting, and compromised maintainers

• Static and dynamic analysis of browser extensions (Manifest V2/V3)
• JavaScript source review: innerHTML sinks, postMessage trust boundaries, prototype pollution
• Shadow AI detection and policy enforcement via proxy interception
• Supply chain risk assessment: permission creep, update hijacking, and C2 callbacks

• Python and Bash scripting for security automation and triage
• mitmproxy (containerized) for HTTPS traffic analysis
• SAST triage pipelines and log sanitization tooling
• SIEM/EDR: Wazuh, Jamf Protect, Tripwire, and SentinelOne
• Containerized lab environments with Docker and Nomad on Linux

• Secrets management: vault architecture, dynamic secrets, PKI automation, credential lifecycle management
• Zero Trust integration patterns across cloud and endpoint environments
• Session security: token hijacking mechanics, OAuth abuse, and credential exposure vectors

Software Supply Chain Security
Syft · Grype · OSV-Scanner · Cosign · OpenSSF

Platform Engineering
GitHub Actions · Forgejo · Nomad

• Software supply chain security: SBOMs, dependency analysis, artifact integrity, and SLSA practices
• Securing CI/CD pipelines through automation, policy enforcement, and zero-trust workflows
• Cloud security engineering: identity controls, secrets management, and infrastructure hardening
• Open source security research: vulnerability analysis, package risks, and dependency trust
• IAM and Zero Trust architecture: least privilege, role separation, and access lifecycle management
• Browser and endpoint security research: extension auditing, data protection, and threat analysis