03About
Engineer first, security now.
Software engineer in Austin. The work these days is application security: the same code, read for what it hides.
I am a software engineer. Most of my work now is application security: reviewing code and APIs, writing scanners for the classes of bug I keep running into, and documenting the process so the next person moves faster.
I came up as a full-stack developer - React and Next.js on the front, Node and Java on the back, Postgres underneath. That background is most of what I bring to a review: I know where the corner gets cut, because I have cut it. It also means when a fix needs to ship, I can write it.
The rest of the time I run language models on my own hardware. GGUF builds, quantization, tokens per second on consumer GPUs - and then a write-up with the actual numbers, including the parts that did not work.
I am based in Austin, Texas. Everything I publish lives on my own infrastructure: this site, the git server behind the work page, and the notes that feed the writing page.
Stack
what I actually reach forSecurity
- Vulnerability research
- Web & API testing
- OAST / out-of-band
- Bug bounty
- Secure code review
- Threat modeling
Frontend
- React
- Next.js
- Vue
- TypeScript
- Tailwind CSS
- shadcn/ui
Backend & platform
- Node.js
- Java
- PostgreSQL
- Docker
- Linux
- CI/CD
AI & local models
- LLMs
- RAG
- llama.cpp
- Agents
- Ollama
- GGUF quantization
Experience
reverse chronological- PresentApplication security
Software Engineer
Software engineering with a focus on application security: reviewing code and APIs, writing the scanners, and documenting the process end to end.
- PreviousFreelance
Full-Stack Developer
Built web applications and AI-powered products end to end: interface, API, data, deploy.
- PreviousForward Flow
Tech Lead / Full-Stack Developer
Led development on web applications and AI-powered products.
- PreviousRed Mountain Scientific
Full Stack Developer
Developed and maintained web applications, APIs, and data pipelines.
How I work
three rulesAuthorized testing only
Scoped engagements, written permission, and a clear line where testing stops. The interesting part is the proof, not the access.
Reproduce before you report
A finding is a claim. I write the smallest repeatable case first, because a reproducer ends the argument faster than a paragraph does.
Write it down
The tooling, the false starts, the numbers. If it only lives in my head it did not happen, and the next person pays for it.
Have something worth reviewing?
Scoped reviews, tooling questions, or a build that needs both sides of the stack.