Application security engineer.
I break software the way attackers would, then help build it back stronger. Pentesting, secure code review, and threat modeling from the dark, glowing edge of the marsh.
.-~~~~~~~-.
.~ o o o o ~.
( o o o o o o )
(o o o o o o o o)
( o o o o o o )
'~-._______.-~'
| : : |
| : : |
| : : |
.-| : : |-.
(___________) Field Report
I’m an application security engineer who treats every codebase like an ecosystem. Most bugs aren’t loud; they grow quietly in the dark, in the gaps between trust boundaries. My job is to go in with a light and find them before anyone else does.
I work across the whole lifecycle: adversarial testing of web, mobile, and API surfaces, line-level secure code review, and threat models that bake security into the design instead of bolting it on. I like clear write-ups, reproducible findings, and fixes that actually hold.
Off the clock you’ll find me in CTFs, poking at auth flows, building 3D toys, and collecting good security writing.
Off the record: the same curiosity that finds injection points also builds glowing fungal interfaces at 2am. This site is the overlap.
Current rotation: CTF seasons — web and pwn, with solve paths anyone can reproduce — teardowns of how modern SaaS actually handles auth, and 3D toys that have no business being this shiny.
If it glows, ships, or breaks in an interesting way, I want to hear about it. The terminal at the bottom of the page knows how to reach me.
Capabilities
Penetration Testing
Adversarial assessment of web, mobile, and API surfaces. I find the path attackers would take, then document exactly how to close it.
Secure Code Review
Line-level audit of source for injection, broken auth, and logic flaws. Manual depth, backed by static analysis where it earns its place.
Threat Modeling
Mapping trust boundaries and abuse cases early, so security is designed into the system rather than bolted on after launch.
App Hardening
Turning findings into durable fixes: auth, headers, input handling, and defense-in-depth that survives the next refactor.
Vuln Research
Digging into how things actually break, for sport and for signal. Disclosure handled responsibly, every time.
Selected Work
Alpha
A shared inspiration board for saving websites, prompts, and design references. Pin a link, add a note, and find it again by category.
Workshop
A procedural 3D workbench. Explore models built from code, adjust their recipes, and export a model or a turntable recording.
Marsh Expedition
Explore a mushroom marsh, meet its inhabitants, and fill your field journal. Follow the trails from camp to the crystal sanctum.
Off the Clock
Lenny's Podcast
World-class product and growth leaders, broken down into tactics you can actually ship.
404 Media
Journalist-run dispatches from the internet’s weird, broken underbelly: hacking, privacy, surveillance, AI.