Security engineering
Find the weak path.
Build the stronger one.
I investigate how modern systems fail, then turn those lessons into safer architecture, delivery, and operation.
Selected work
Systems, decisions,
and their consequences.
Capstone
Automated, security-gated delivery on AWS EKS
A platform that takes five containerized apps from a Git push to a running AWS EKS cluster, with security checks that can stop the release.
- exposed
- public ingress · container images
- checks
- scanning gates before release · policy-as-code
- result
- releases blocked on failed scans · cluster matches Git
Hotel Rating System
Identity and failure handling across microservices
Several microservices behind one gateway, with Okta handling login and circuit breakers keeping one failure from spreading.
- exposed
- OAuth flows · API gateway
- checks
- OIDC token validation · request rate limits
- result
- authenticated service calls · bounded failure
Project Management System
Access control for a real-time team app
A team workspace with chat, invites and subscriptions, where every API request is checked against a JWT before it reaches the code that answers it.
- exposed
- REST endpoints · JWT lifecycle
- checks
- request-level token validation · role checks
- result
- bounded project access · real-time team chat
Research
Research that changed
real systems.
CVE-2026-61549 Unrestricted workload identity in Kubernetes backend High · 7.5
- What was assumed
- A pipeline author could safely choose any service account available in the namespace.
- What could happen
- A workload could run under a highly privileged, potentially cluster-admin, service account.
- How it was fixed
- Restrict service-account selection and apply least privilege at workload admission.
- Status
- PATCHED · 3.16.0
CVE-2026-40893 ExifTool dangerous-tag blocklist bypass High · 8.2
- What was assumed
- Blocklisted tag names would always arrive in one canonical form.
- What could happen
- An attacker could influence file rename and move behavior during document processing.
- How it was fixed
- Normalize and validate group-prefixed tag names before evaluating the dangerous-tag policy.
- Status
- PATCHED · 8.31.0
CVE-2026-23603 Blind SSRF through OAuth2 avatar synchronization Low · 3.1
- What was assumed
- The identity provider's picture claim was safe to fetch from the server network.
- What could happen
- A low-privileged user could trigger blind requests to otherwise unreachable internal URLs.
- How it was fixed
- Validate remote avatar destinations and constrain outbound fetch behavior.
- Status
- PATCHED · 1.27.0
Recent notes
What the path
looked like up close.
Go Knock on That Door for Me: My Blind CVE Story
A quiet story about CVE-2026-23603, a low-severity blind SSRF in Gitea, where a helpful avatar fetcher would knock on any internal door you pointed it at — and, once in a while, bring a picture back.
The Name Tag That Said 'Admin': My CVE Story
A small story about CVE-2026-61549, a privilege escalation in Woodpecker CI's Kubernetes backend, where a pipeline could hand its Pod any identity it liked — and nobody checked the name tag.
The Tiny Colon That Moved a File: My CVE Story
A simple story about CVE-2026-40893, a small ExifTool metadata bypass in Gotenberg where one tiny colon made a security blocklist look the other way.