/ Projects
The first two were built with a teammate against a hackathon clock, and are running in production on their own subdomains. The rest are mine alone, and exist because I hit the same friction more than twice and got tired of it. Every repo is public.
01 · Shipped at a hackathon
My halfThe policy engine, the signed provenance chain, the interceptor and the live agent. The console is Jayden Maans's. 24 of 40 commits are mine.
A policy and provenance gateway that sits between an AI agent and its tools. Every action the agent attempts is checked against deterministic policy before it runs, and every attempt, allowed or denied, is written to an Ed25519-signed, hash-chained log that proves nothing was edited afterwards.
The security boundary contains no language model.
# first match wins. a policy cannot default to ALLOW. rules: - id: read-secrets-deny tool: read_file when: { path_prefix: /secrets/ } outcome: DENY - id: pay-within-limit tool: make_payment when: { max_eur: 50 } outcome: ALLOW default: DENY
Each entry hashes the one before it and is signed. Edit a single record and its hash stops matching, so every link after it goes dead. You cannot quietly remove the payment you were denied.
135
Tests passing
40
Commits
4
Tools guarded
0
LLMs in path
02 · Shipped at a hackathon
My halfThe scan engine, all seven checks, the API and the deployment. The frontend and the spoken briefings are Jayden Maans's. 48 of 69 commits are mine.
Passive security assessment for people who do not have a security team. Submit a domain, get a score out of 100 and a letter grade across seven checks, written so a business owner can act on it instead of forwarding it to someone who can.
A scan output is not a report.
Nothing is exploited and nothing is brute forced. Every check runs asynchronously behind a 24 socket semaphore, so a scan stays polite enough to point at a domain you were merely asked to look at. The certificate log services did not answer on this run, so that check reports no answer and is left out of the score rather than counted as a failure.
A
0/ 100
certifa.net, live scan
Each finding comes with a plain language recommendation, an optional spoken briefing, and a side by side against a competitor's domain. The grade is the hook. The recommendation is the product.
450+
Tests passing
69
Commits
7
Risk checks
AA
WCAG 2.1
The rest · built for my own workflow
03
A pentest tracker shaped like the way I actually work, instead of a generic checklist that assumes every box is the same.
04
Two passes instead of one. Sweep every TCP port, then only spend fingerprinting time on the ports that actually answered.
05
Reverse shell payloads without the copy-paste tax, and without a browser tab open on someone else's cheat sheet.