I'm a cybersecurity engineer who builds security products end to end: threat model, backend, agent, UI, tests, and deployment. My main work is FreNiMiGuard, a vulnerability-management platform I designed and built at FreNiMi. Outside that, I land security fixes upstream in CISA, OWASP, and Prowler projects.

Each claim on this page links to something you can check, and I state the limits alongside the results.

FreNiMiGuard matches every asset's installed software against CISA's Known Exploited Vulnerabilities catalog and NVD. It ranks what to fix first and sets an SLA deadline and owner. It can push the fix through an endpoint agent the customer installs, then checks that the fix actually landed. Closed findings become NIST 800-53 and OSCAL evidence.

Visit the live product · Read the evidence record

_{The dashboard on a test instance, 3 Oct 2026: live CISA KEV and NVD feeds matched against a sample inventory of third-party apps on five machines. Not customer data.}

What I built: a FastAPI backend with SQLCipher storage, a React and TypeScript frontend, NVD and CISA KEV feed ingestion with CPE version-range matching, Intune, Jamf, and CSV inventory import, SAML SSO, role-based access, OSCAL SSP, SAR, and POA&M export, and Windows, Linux, and macOS endpoint agents with signed remote actions.

An agent that runs fixes on customer machines is a remote-code-execution channel, so I treated it as the main attack surface:

_{The same controls in the product's endpoint settings.}

Found and fixed in my own code:

• The read-only auditor role could write to assets, incidents, alerts, controls, compliance answers, and integrations. Every write path now requires the editor role.
• python-jose pulled in an unpatched ecdsa dependency. I migrated JWT handling to PyJWT and kept the algorithm allow-list.
• Every known-exploited Windows CVE matched every Windows machine by name, so a patched Windows 11 laptop showed EternalBlue. Windows findings are now checked against NVD's data for the machine's own release and build. On real CISA and NVD data, a machine reporting its full build got a definite answer on every Windows CVE checked: 47 ruled out, 14 confirmed. Insider and unknown builds are never ruled out.
• NVD records list the platform a product runs on beside the vulnerable product, and the feed counted both, so a GLib bug matched every Windows machine. Only vulnerable products and real version bounds count now. On the one live workstation, open findings fell from 1,457 to 462.
• Signing in logged false "Compliance update" audit events, because loading the checklist also saved it. Loading no longer writes anything.
• Pages were served without CSP, HSTS, or anti-framing headers, because an nginx block that sets its own headers silently drops the server-wide ones. Every response now carries them.

_{FreNiMiGuard source is in a private repository, so these tests and audits can't be reproduced from this public profile. The newer test counts are from the private source checkout; they do not establish that those changes are deployed. No penetration test, authorization to operate, compliance certification, or customer deployment is claimed. The evidence record says exactly what these results do and don't prove.}

Only merged work is listed. These are contributions to the upstream projects, not claims that their fork mirrors are products I maintain. The Open Source Log keeps the dated record and separates merged work from PRs still under review.

These projects target different jobs: phishing triage, exposed-secret detection, event-level log signals, population-based anomaly triage, and CVE remediation guidance. Start with the linked quick-start in each repository before using it on real data.

Tool	What it does	Output	Tests
PhishGuard	Scores URLs and email for phishing offline and explains each score	SARIF · Marketplace Action · Evidence
Secrets Scanner	Finds exposed credentials in CI and redacts them in findings	JSON · SARIF · GitHub Action · Evidence
Log Analyzer	Turns raw logs into MITRE ATT&CK-mapped investigation leads	SARIF · GitHub Action · Evidence
BehaviorSense	Scores user and IP activity for explainable anomaly triage	Python · TypeScript · Evidence
VulnGPT	Turns NVD CVE data into prioritized remediation guidance	NVD · CVSS · CWE · Evidence

Choosing a tool: use Log Analyzer for explicit indicators in individual log events and BehaviorSense for unusual behavior compared with a population baseline. CVE Dashboard is a quick filtered NVD feed (evidence); VulnGPT turns an individual CVE into triage and remediation guidance.

FreNiMi Checkers is a separate product-engineering project: an American-checkers game with local AI, offline play, and an optional ranked multiplayer service. The browser demo is the fastest way to try it; server-backed matchmaking requires a separate deployment.

In a live launch-readiness review of the tutoring marketplace, I found transaction-integrity and access-control gaps. I implemented source fixes and added regression tests in LearnFolk PR #1. The changes are not deployed: the PR is open, a database migration is required, and production retesting remains a launch gate. I do not present these source fixes as a production resolution.

If you work on application security, vulnerability management, or detection engineering, I'd like to compare notes or build something useful together.

FreNiMiGuard · Website · LinkedIn · Writing · HackerOne · Email