Security tooling · Systems software · Applied AI
I build tools that make complex systems easier to understand and work with, from security research pipelines to local applications and browser games.
My focus is reproducible behavior, clear documentation, and useful interfaces. Explore my public work below.
Three projects with accessible source code and documentation, covering systems integration, API workflows, and browser application design.
Python · Flask · JavaScript · Three.js
A local web application for editing Borderlands 2 characters and inventory, with Gibbed code import/export and an optional 3D asset viewer.
Engineering focus: binary save formats, backup and write workflows, and an interface for complex game data.
Python · FastAPI · Click · Gmail API
A command-line tool and local web UI for bulk Gmail operations, unsubscribe workflows, and a local subscription registry.
Engineering focus: OAuth integration, batch operations, and a consistent workflow across the CLI and browser UI.
JavaScript · HTML · CSS · Web Audio
A daily flag game with two modes, practice rounds, browser-local progress, and a synthesized lofi soundtrack.
Engineering focus: deterministic daily puzzles, color matching, and a static application with no build step.
More public work: RL Map Manager and Roblox Multi-Instance.
Independent security research into trust boundaries in AI-assisted developer tools, supported by reproducible experiments and responsible disclosure.
Responsible disclosure · Anthropic · May 2026
Submitted a security report to Anthropic investigating how repository-provided hooks and MCP configuration interact with workspace trust and non-interactive execution in Claude Code.
Prepared reproduction cases, permission-mode comparisons, and startup timing evidence, then followed up with Anthropic’s security team to examine alternative explanations.
Recognized by Anthropic: Anthropic recognized the submission and found that it was informative and aided in discovering other vulnerabilities.
The additional projects below are currently private. They describe my areas of work; the public projects above are available for source review.
BootGate explores pre-OS password gating through UEFI and EDK II, including password derivation, recovery flows, and QEMU-based testing.
Hostcheck and Leakcheck explore host hardening and VPN diagnostics, translating technical findings into explanations and suggested actions.
Polysec Harness explores role-specialized language-model agents for security research, with separate investigation and verification stages.
My interests include reproducible findings, sandbox boundaries, severity calibration, and the cost of running multi-agent workflows.
Open to conversations about security, systems, and applied-AI engineering opportunities.