About
The Manifesto
Software is only as trustworthy as the assumptions it ships with. I write about the ones that fail under pressure.
I'm a security-focused full-stack web developer. My day-to-day is split between building production systems — auth, APIs, real-time pipelines — and breaking them on purpose to find out where the seams are.
This site is where I write up what I've learned: zero-trust architecture, hardening GraphQL surfaces, high-performance crypto with Rust and WebAssembly, and the everyday discipline of defense in depth.
What you'll find here
- Disclosures — long-form posts on application security, threat models, and post-incident write-ups.
- Field notes — shorter, sharper takes on tools, libraries, and the trade-offs they impose.
- Open source — libraries and utilities I maintain in the open. Issues and PRs welcome.