Things I've built.
Detection engineering, LLM & MCP security, and secure tooling. The ones with a write-up open a case study; the rest link straight to source.
RedCell
Security scanner for LLM applications and MCP agents. Adversarial probes mapped to the OWASP LLM Top 10, with live excessive-agency testing against MCP servers and indirect-injection detection that distinguishes a model obeying an injected instruction from merely quoting it. Zero false positives on hardened controls.
Argus — formerly SOC Simulator
Self-hostable SIEM with real log ingestion over syslog, HTTP, and file sources. Sigma detection rules, an AST-based query parser, and threat-hunting and incident-response workflows mapped to MITRE ATT&CK — plus a synthetic APT killchain generator for training and detection validation.
OSINT CyberBot
Serverless threat-intelligence pipeline on GitHub Actions ingesting 13 authoritative RSS feeds, parsing unstructured reports with LLaMA 3.1 and Pydantic-validated JSON extraction. Enriches CVEs with NVD CVSS, CISA KEV, and FIRST EPSS signals into a weighted 0–100 risk-priority score, with three-layer deduplication and a read-only FastAPI service behind rate limiting and injection guardrails.
Sentinel
Automated web vulnerability scanner detecting OWASP Top 10 classes including injection and security misconfiguration, mapping each finding to its CWE identifier so results point at root cause rather than symptom. Backed by a regression suite giving every detector a known-positive and known-negative case.
DCT Steganography
Digital watermarking system embedding hidden payloads in image matrices using adaptive AI-chosen blocks and ECC for integrity.
Secure Comm App
Real-time encrypted communication platform on AWS with secure channels, server log monitoring, and reliable uptime management.