$ ls ~/work
Each project from both sides - how I built it, and what it means for security.
Client and project details are kept generic on purpose.
Angular · .NET WebAPI · MySQL
dev view
Built a full-stack platform that improved decision-making efficiency by 25%, with geo-location visualisations.
security view
Role-based access control with multi-region data segregation - users only see data for their own region.
React · .NET · PostgreSQL · gRPC
dev view
Real-time device onboarding and monitoring over gRPC.
security view
Device trust and an internal gRPC API surface - exactly the kind of interface that leaks when reflection is left on.
Docker · reverse proxy · Prometheus · Grafana · Watchtower
dev view
30% performance improvement through containerisation, reverse-proxy isolation and distributed logging; automated releases from a private registry.
security view
Reverse proxy isolation limits what is reachable. The auto-update setup later became my favourite example of mutable tags as attack surface.
Burp Suite · ZAP · Nmap · Nuclei · SQLmap · Nessus · SysReptor
dev view
-
security view
Found critical issues including SQL injection, XSS, CSRF, RCE, LFI, CORS misconfiguration and cache poisoning. Wrote reports and remediation plans, then worked with developers to fix them.