Cybersecurity & DevSecOps engineer based in Lyon, France. I hold the French RNCP Administrateur d'Infrastructures Sécurisées title (Guardia Cybersecurity School, 2026), and I currently own application and production-server security for a web agency's entire client estate — the whole loop, from finding the vulnerability to watching the fix ship.
My work sits on both sides of the wire: I audit and exploit (OWASP Top 10, bug bounty, red-team tooling), then I build the controls that make the same class of bug impossible next time (pipeline gates, hardened images, network segmentation).
|
Security as a pipeline property, not a good intention.
A committed secret doesn't reach production. It breaks the build. |
You cannot defend an attack path you've never walked.
|
Linux, containers, and the blast radius around them.
|
Each of these exists to prove one thing. That thing is in the right-hand column.
| Project | What it is | What it demonstrates |
|---|---|---|
| ExploitSpec | Turns proven exploits into permanent regression tests — import a sanitized cURL, express the invariant in YAML, run locally or in GitHub Actions. | Bridges offensive findings and defensive CI: RED → GREEN → STABLE. Local-first, no account, no telemetry, Apache-2.0. |
| gauntlet | Secure remote-code-execution & online-judge platform. Treats every submission as hostile. | Container escape defence — seccomp, cgroups, dropped capabilities, user namespaces, optional gVisor. Full THREAT_MODEL.md. K8s manifests with deny-all-by-default NetworkPolicy, non-root pods, read-only rootfs. |
| aedsc-action | GitHub Action running Slither + Aderyn on every pull request. | Shift-left security in practice — automated scanning wired into the review loop, with results where developers actually read them. |
| T3MP3ST | Autonomous red-teaming platform — a multi-agent offensive-security meta-harness. | Offensive automation and attack-chain orchestration. |
| mldsa-kit | FIPS-204 ML-DSA-87 post-quantum signing for Rust, with an encrypted keystore. | Applied cryptography — Argon2id + AES-256-GCM key protection, byte-for-byte browser↔native interop, stable toolchain. |
| pricestream | Real-time crypto pricing & liquidity service — Django, Kafka, Celery, WebSockets. | Distributed systems and observability — Prometheus metrics, deep health probes, Kubernetes manifests, CI. |
| NightOwl | 57-module open-source pentesting framework. | Breadth across the offensive toolchain. |
More — infrastructure, backend, Web3
| Project | Stack |
|---|---|
| market-data-collector | Async Python → Kafka. asyncio, aiokafka, mypy --strict, multi-stage Dockerfile |
| pricing-grpc-service | Async gRPC, unary + server-streaming, strict typing, CI |
| zenith | Solidity contracts for a rollup system |
| concierge | Unified hotel-facing touchscreen platform (TypeScript) |
What I do outside GitHub — application and infrastructure security for a web agency's client estate.
|
Built the DevSecOps pipeline Went from manual, occasional review to automated gating on every push: Semgrep (SAST), Trivy (dependencies + images), Gitleaks (secrets), OWASP ZAP (DAST) — with a CycloneDX SBOM and Cosign signature on what ships, and base images rebuilt distroless and non-root. Audited the estate, then got it fixed White-box audit of a production SaaS (Angular / Laravel): 45 vulnerabilities scored OWASP / CWE / CVSS, including a CVSS 9.9 privilege escalation and IDOR across 11 controllers. Then three internal applications — 31 findings on a Next.js CRM, and 52 of 53 findings actually remediated on an accounting application. Finding bugs is the easy half. Getting them closed is the job. |
Hardened the production servers Defence in depth on the estate's production host: SSH key-only, ModSecurity + OWASP CRS switched to blocking, CrowdSec and Fail2ban (~15 000 IPs banned), 7 Docker ports pulled off the public internet, 9 kernel CVEs patched. Lynis score 67 → 77. Handled a real intrusion attempt A file-inclusion attempt targeting Then re-verified it two months later. The controls still held. Hardening that isn't re-checked is hardening that quietly rotted. |
Same discipline, different threat model — and the reason I went deep on applied cryptography.
No fork, no copy-paste. Consensus, crypto, networking, storage, VM and API all implemented from zero on NIST-standardised post-quantum primitives — because every chain in production today signs with ECDSA, which Shor's algorithm breaks.
ML-DSA-87 / CRYSTALS-Dilithium L5 (FIPS 204) · SHA-3 Keccak-256 · BFT PoS with slashing · Wasmer 5 + Cranelift WASM VM with fuel metering · libp2p + Gossipsub · AES-256-GCM + Argon2id wallet
Live public developer testnet, 5 validators across 4 providers, MetaMask-compatible JSON-RPC alongside native post-quantum transactions. Not audited, not production, no monetary value — deliberately.
Also: mldsa-kit (post-quantum signing library), zenith (rollup contracts), aedsc-action (Solidity security scanning in CI).
role: Application & infrastructure security — agency client estate
focus:
- Kubernetes security: RBAC, NetworkPolicies, admission control
- Supply-chain integrity: SBOM, signing, provenance
- Detection engineering on production Linux hosts
learning: [ CKA, threat modelling at design time, eBPF observability ]
open_to: DevSecOps / security engineering roles — Lyon, France
languages: FR native · EN C1 · IT B2Security that isn't automated is security that happens when someone remembers.