Security-focused developer working on open-source software, developer tooling, and practical security research.
I like problems that need a reproducible answer: trace the behavior, isolate the failure, make the smallest useful change, and leave a regression test behind.
LinkedIn · HackerOne · Bugcrowd · Intigriti · YesWeHack
Most of my recent work has been upstream: debugging existing systems, writing focused fixes, adding regression coverage, and working through maintainer review. I have 140+ merged pull requests in repositories I don't own in the last 12 months.
A few representative contributions:
| Project | Contribution |
|---|---|
| TheAlgorithms/Python | Constrained TimSort inputs to comparable values, tightening the implementation and its typing contract. |
| RustDesk | Fixed Windows foreground activation for an existing session. |
| OpenLayers | Fixed MouseWheelZoom target cleanup, including lifecycle and interaction-state handling. |
| sktime | Made SubLOF compatible with pandas 3. |
| OpenTelemetry PHP | Fixed SDK global attribute-limit fallbacks with regression coverage across the affected limits. |
| Nextcloud Mail | Fixed detection of application/octet-stream ICS attachments. |
| GitHub Advisory Database | Contributed advisory metadata fixes, including PickleScan and Gitea fix references. |
| planning-with-files | Contributed a series of reliability fixes across project attestation, PowerShell pointer replacement, OpenCode replay handling, and active-plan state; for example #297 and #287. |
HeaderProof is the security project I maintain. It is built around evidence rather than noisy heuristics: probe HTTP behavior, preserve the response that supports a finding, and keep conclusions reproducible.
The current work covers CORS and CSRF behavior, response/header injection, cache-related issues, content reflection and other HTTP security checks, with profiles for controlling scan behavior and output intended to be useful during authorized testing.
Related repositories: headerproof-action · headerproof-templates
Security research: HTTP behavior, web application security, bug bounty, attack-surface analysis, validation, and low-noise automation. Daily environment includes Linux/WSL, Burp Suite, Nuclei, Nmap, and ProjectDiscovery tooling.
Security work is performed in authorized environments and within the applicable program or project scope.