Systems Security · Distributed Backend · Security Engineering

I build security-focused backend and distributed systems with an emphasis on reliability, authorization, defensive infrastructure, and failure-aware design.

I engineer systems where correctness depends on more than the happy path:

• What happens when a worker crashes halfway through a job?
• What happens when the same event arrives twice?
• What happens when two workers claim the same resource?
• What happens when authentication succeeds but authorization should fail?
• What happens when an attacker controls an input that becomes a network request?

I design around those questions.

Core principles I work by:

• Make failure explicit and observable
• Treat security as a boundary problem
• Prefer evidence over adjectives (“secure” → what attack, what invariant, what mechanism, what test?)
• Always ask: what does this system actually guarantee?

HookRelay is the current centerpiece — a durable distributed workflow rather than a simple “receive → forward” endpoint.

Security
Application security · Authentication & Authorization · SSRF · Replay attacks · Request signing · CSRF · Rate limiting · Secret management · Supply-chain security · Prompt injection / tool authorization · Zero-trust architecture

Distributed Systems
Durable queues · Worker coordination · Leases & fencing tokens · Idempotency · Retries & dead-letter queues · Concurrency control · Database locking · Failure recovery · Observability

DevSecOps
Gitleaks · Bandit · pip-audit · SHA-pinned GitHub Actions · Automated security tests · Containerized development · Structured logging & metrics

I prefer security controls that run automatically rather than remaining a final manual checklist.

1. Define the threat model — Who can control the input? What can they influence?
2. Define the invariants — What must never happen?
3. Define failure modes — Database down, worker crash, network timeout, duplicated request, malicious input
4. Implement the smallest correct boundary
5. Test the assumptions — especially the ones that are easy to forget

Backend · Python · FastAPI · AsyncIO · SQLAlchemy · PostgreSQL
Infrastructure · Redis · Docker · Prometheus · GitHub Actions
Security · OWASP · Burp Suite · Ghidra · Bandit · Gitleaks · pip-audit
AI / Agents · LangGraph · MCP · Ollama
Systems · Linux · Networking · Packet inspection

Roles where I can work on:

• Security-sensitive backend systems
• Distributed infrastructure / platform engineering
• Application security & DevSecOps
• Agent infrastructure & tool authorization
• Reliability engineering

I enjoy moving between design, implementation, debugging, security analysis, and deployment.

Don’t just make it work.
Understand why it works.
Understand when it fails.
Make the failure observable.
Make the security boundary explicit.
Test the assumption.
Then optimize it.

Build systems that remain understandable when everything goes wrong.