./projects
Things I built, and what they taught me
Source is public where the client allowed it. Where it isn't, the write-up explains the approach without the proprietary parts.
A continuous attack-surface monitor. It enumerates subdomains, ports and certificates on a schedule, diffs each run against the last, and alerts only on genuine change — new host, new open port, expiring cert.
The hard part was not discovery, it was suppressing noise. Alert fatigue kills a tool faster than a missing feature.
Multi-tenant billing for small SaaS teams: recurring invoices, proration, dunning emails and revenue reporting, with a strict tenant-isolation model enforced at the query layer rather than in application code.
Row-level isolation belongs in the database. Every authorization bug I found in review was in code that tried to do it by hand.
A Burp extension that replays every captured request across each configured user role and flags responses that differ from the expected authorization outcome. Written after finding the same broken-access-control bug in four consecutive audits.
Most access-control testing is manual and therefore incomplete. Automating the boring half found bugs I would have missed.
A small command-line tool that watches DNS records for a domain set and reports drift — dangling CNAMEs pointing at deprovisioned cloud resources, the classic subdomain-takeover setup.
A tool that does one thing gets adopted. My first version tried to do six and nobody installed it.
Real-time operations dashboard for a logistics client: live vehicle positions, delay prediction and an alerting console, rendered without dropping frames on a wall-mounted display running twenty-four hours a day.
Perf work is a security feature too — the memory leak we fixed was also a denial-of-service vector.
Takeover of a forgotten staging host
Disclosure · coordinated fix
A dangling DNS record on a well-known company's staging subdomain let me claim the host and serve content on their domain. Reported through their programme, fixed inside eleven hours, disclosed with permission.
The vulnerability was two years old and cost nothing to exploit. Inventory is security.
Everything else — smaller tools, CTF solutions and half-finished experiments — lives on GitHub.
Browse the repositories ↗