Software engineer focused on application security, secure code review and testable remediation.

I build web applications and automation tools with TypeScript, Next.js and Python. My security work focuses on authentication, session handling, server-side trust boundaries and regression tests. This portfolio links the code, threat models and validation evidence behind that work.

LinkedIn · Public repositories

A Next.js and TypeScript application with a maintainer security review covering administrative authentication and session management.

• Assessment: scope, controls, four findings and retest criteria.
• Threat modeling: STRIDE analysis and trust boundaries.
• Regression coverage: session tests for expiry, tampering, invalid signatures and legacy cookie rejection.
• Recorded validation: CI run #19 completed successfully on September 5, 2026, at commit d3160b5. Its Vitest report records 91 passing tests across 8 files in the project suite.

The August 29 review documents a separate baseline with 33 passing tests. It identifies limitations in per-instance rate limiting, forwarded-address trust, legacy tokens in URLs and session revocation. Use the current source and CI history to assess later changes; the test totals do not establish that every finding has been resolved.

A Next.js shopping cart integrating Stripe checkout. The payment security architecture documents the browser/server boundary, backend secret handling and checkout validation.

Repository · Security policy · CI history

A Python project combining Camoufox, persistent browser sessions, a CLI and a 17-tool Model Context Protocol server. Documented use cases include authorized QA, accessibility, browser compatibility and agent evaluation. Browser profiles, cookies and saved sessions are sensitive data and require explicit scope and careful handling.

Project and test instructions · Architecture · Security design · Security policy · CI history

My focus is using AI assistance for code understanding, threat modeling, test design and remediation review, with human review of findings and changes. The intended outcome is a reproducible finding, a reviewable fix and a regression test.

1. Define scope: work on my own projects or systems explicitly authorized for testing, in controlled test environments.
2. Trace the risk: connect authentication, authorization, input validation and secret-handling concerns to specific code paths and trust boundaries.
3. Validate the finding: check assumptions against source and reproducible tests before treating an AI-generated finding as confirmed.
4. Review and retest: evaluate the proposed change, run the relevant checks and document remaining limitations.
5. Protect sensitive data: keep credentials, session exports and confidential information out of public issues and shared examples; follow the affected project's security reporting policy.

The linked assessments are maintainer reviews and project documentation. CI results are evidence of the configured checks at the referenced commit.

Development: TypeScript, JavaScript, Python, SQL, HTML/CSS, Next.js, React, Node.js, Express.
Automation: Playwright, Camoufox, FastMCP.
Testing and security: Vitest, pytest, Ruff, ESLint, Gitleaks, GitHub Actions, STRIDE threat modeling.

For professional contact, use LinkedIn. For security findings, follow the affected repository's security policy.