I work on uncovering security weaknesses across web applications, APIs, cloud environments, CI/CD pipelines, and AI-assisted software — and more importantly, engineering robust fixes.

My approach is practical and evidence-driven:

Reproduce the issue ➔ Diagnose root cause ➔ Engineer the fix ➔ Implement regression tests ➔ Automate continuous prevention.

With rapid software delivery and the rise of AI-assisted software development, code is shipped faster than ever, but architectural security considerations and subtle vulnerabilities are frequently overlooked. I specialize in identifying these vulnerabilities early and hardening applications before they reach production.

• Application & API Security: OWASP Top 10, API Security Top 10, secure session management, CSRF/XSS defense.
• Secure Code Review (SAST): In-depth source code analysis across Python, PHP, JavaScript, and TypeScript codebases.
• AI-Generated Code Security: Identifying dangerous hallucinations, insecure deserialization, SQL injection, and command injection in AI-assisted code.
• DevSecOps & CI/CD Hardening: Automated security scanning (SARIF, Ruff, Bandit, Semgrep) integrated into GitHub Actions with least-privilege permissions.
• Authentication & Access Control (RBAC): Object-level authorization (BOLA/IDOR prevention), multi-tenant ACLs, and cloud security rules.
• Secrets Detection & Remediation: Automated pipeline secret scanning, credential rotation workflows, and secure environment isolation.
• Security Testing & Vulnerability Remediation: Engineering defensive patches backed by reproducible automated tests to prevent security regressions.

• The Vulnerability: An API endpoint authenticated users but relied solely on client-provided IDs without verifying tenant ownership.

  GET /api/orders/10452 HTTP/1.1
  Authorization: Bearer <valid_token_for_user_A>

  (Changing the ID exposed records belonging to User B).
• The Engineering Fix: Enforced strict server-side ownership binding in query scopes rather than trusting request parameters:

  # Safe: Verifies tenant ownership directly in the database lookup
  order = db.query(Order).filter(
      Order.id == order_id,
      Order.account_id == current_user.account_id
  ).first_or_404()

• Key Principle: Authentication verifies identity; Authorization verifies permissions. Both must be enforced independently on every request.

• The Vulnerability: Dynamic string concatenation or unescaped interpolation in database lookups.

  # Unsafe pattern
  cursor.execute(f"SELECT * FROM users WHERE email = '{user_input}'")

• The Engineering Fix: Parameterized prepared statements combined with automated regression tests:

  # Secure pattern
  cursor.execute(
      "SELECT id, username, email FROM users WHERE email = %s",
      (user_input,)
  )

• The Problem: API keys, database credentials, or tokens inadvertently committed to source code or configuration files.
• The Remediation Protocol:
  1. Immediate Revocation: Rotate/revoke the active key at the provider level immediately.
  2. History Cleansing: Purge the secret from git history using tools like git-filter-repo.
  3. Environment Isolation: Migrate to secure environment variables or vault secret managers.
  4. Automated Prevention: Deploy pre-commit hooks and CI detection (e.g., Gitleaks, Bandit, custom SAST) to block commits containing high-entropy strings.

• The Vulnerability: Application code delegating system operations through shell interpreters with user input:

  # Unsafe: Shell interpolation allows command chaining (e.g., '127.0.0.1; rm -rf /')
  os.system("ping -c 1 " + ip_address)

• The Engineering Fix: Use argument-vector subprocess execution with shell=False and strict regex input validation:

  import subprocess
  import ipaddress
  
  # Validate format strictly
  validated_ip = str(ipaddress.ip_address(user_input))
  subprocess.run(["ping", "-c", "1", validated_ip], check=True, shell=False)

• The Challenge: LLM agents equipped with system tool calls can be coerced via prompt injection to execute unauthorized actions or exfiltrate private data.
• Defensive Architecture:
  • Least Privilege for Tools: Disallow destructive tool calls without mandatory human-in-the-loop authorization.
  • Strict Sandboxing: Run agent-generated code inside disposable, network-restricted container runtimes.
  • Output Validation & Schema Enforcement: Validate LLM output against strict JSON schemas before passing to downstream internal APIs.

Core Languages
AppSec & SAST / DAST
DevSecOps & Cloud
AI & LLM Security

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  01 IDENTIFY │ ──> │ 02 VALIDATE  │ ──> │03 UNDERSTAND │
│ Code Review, │     │ Confirm True │     │ Diagnose     │
│ SAST & Scans │     │ Exploitation │     │ Root Cause   │
└──────────────┘     └──────────────┘     └──────────────┘
                                                 │
                                                 ▼
┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  06 PREVENT  │ <── │   05 TEST    │ <── │ 04 REMEDIATE │
│ CI/CD Gates  │     │ Regression & │     │ Implement    │
│ & Automation │     │ Edge Tests   │     │ Secure Fix   │
└──────────────┘     └──────────────┘     └──────────────┘

I provide dedicated application security assessments, secure code auditing, and vulnerability remediation services for startups, dev agencies, and software engineering teams:

• AI-Generated Code Security Audits: Reviewing software generated by LLM coding assistants to eliminate hidden vulnerabilities.
• Application & API Penetration Testing: Identifying authorization flaws, injection patterns, and business logic flaws.
• Secure Code Review: Line-by-line manual reviews and custom SAST rule implementation.
• DevSecOps Pipeline Integration: Embedding automated security gates into GitHub Actions and CI/CD pipelines.
• Remediation Engineering: Working directly with development teams to write, test, and ship security patches.