Built for authorized testing and learning only.
A JavaScript intelligence tool for web penetration testing. Maps routes, API endpoints, guards, and role-related patterns, then prioritizes testing leads with supporting evidence. Findings are leads to investigate—not vulnerabilities until validated. Reports as SARIF with baseline diffs.
Python, AST analysis
A web-reconnaissance framework in development. Eclipse organizes discovered pages, technologies, findings, and relationships into a persistent graph, with hashed HTTP evidence to help keep investigation results traceable.
Go, PostgreSQL, Cytoscape.js
Not public yet, in development
An asynchronous vulnerability-assessment framework for testing for XSS, SQL injection, SSRF, RCE, SSTI, and GraphQL injection, with out-of-band callbacks and reporting.
Python, AsyncIO
A Linux and Windows privilege-escalation helper that checks for risky SUID/SGID paths, potentially vulnerable binaries, and kernel-CVE indicators to guide further manual investigation.
Python
A C-based research tool for inspecting Windows Portable Executable files, including PE headers, RVA translation, and relocation handling.
C
Work experience
I built the product. Then I tested its security.
Archon is an AI agent for small businesses that handles customer conversations across WhatsApp, Instagram, and Messenger. I built the backend, database, AI orchestration, integrations, and security controls. Two major engineering challenges were response latency and tenant isolation.
I designed business-scoped context and authorization boundaries (Clerk for authentication), then assessed the product through black-box testing and source review while building it. Later I reviewed the source again as an outside researcher and wrote up the results in the report below.
A source review of Archon: 14 findings, each with CWE, impact, fix, and a validation test.
Scope is stated up front. This is a static review of my own project with no live target tested, so findings are candidates until runtime evidence exists. Routes, identifiers, code, and exact versions are redacted. * means severity is provisional.
| ID | Finding | Severity |
|---|---|---|
| 001 | Unauthenticated message read by conversation ID | High* |
| 002 | Conversation not bound to agent or tenant | High* |
| 003 | Webhook verify token written to logs | Medium |
| 004 | In-memory rate limit, forwarded-IP trust | Low–Medium |
| 005 | CSP allows unsafe-inline and unsafe-eval | Low |
| 006 | TypeScript build errors ignored | Info |
| 007 | Cross-tenant agent reassignment via PATCH | High |
| 008 | SSRF in knowledge URL ingestion | High |
| 009 | Unauthenticated Gmail webhook triggers polling | Medium–High |
| 010 | Unsigned OAuth state | Medium–High |
| 011 | Next.js and Sharp inside advisory range | Critical, conditional |
| 012 | Cron auth fails open if secret unset | Medium, conditional |
| 013 | OAuth tokens in PATCH response | Low–Medium |
| 014 | OAuth tokens stored in plaintext | Medium |
Technical write-ups and perspectives on how attacks work, how people make security decisions, and what it takes to enter the field.
An explanation of how believable pretexts, publicly available information, and manipulated trust can undermine otherwise strong technical controls.
Social engineering, OSINT, Security awareness
A perspective on the entry-level cybersecurity experience gap, the limits of portfolios as hiring evidence, and ways employers could better support junior practitioners.
Cybersecurity careers, Industry perspective
A practical TryHackMe write-up documenting the SQL injection learning process.
TryHackMe, SQL injection, Web security
About 140 students across seven cohorts, all at MCIT.
Cybersecurity Instructor, Feb to Jul 2026
I taught networking, Linux, web security, and penetration-testing methodology through hands-on labs. I also led sessions and helped students troubleshoot when the lead instructor was unavailable. Teaching sharpened my ability to explain technical concepts clearly and work through problems methodically.
