The Wrong Claim
My own limitations file said injection resistance rested on one live path into a model prompt. Reading the code that builds that prompt found a second one, and a bug inside the fix while I re-measured it honestly.
Writing
Technical investigations.
Clear technical writing for recruiters and practitioners: the investigations, methods, and engineering reports that show how I reason, verify results, and communicate limitations.
Articles and reports
A Support Answer You Can Prove
Eight different SAML failures can all look like "SSO is broken." A recorded case shows a confident, well-formed model draft rejected by a gate that checks claims against evidence, not fluency.
How Do You Know Your AI Agent Isn't Going Rogue? Start by Watching It Behave
I recorded 1,011 model-selected MCP calls across six server configurations to learn what legitimate agent behavior looks like before writing abuse detections.
Catching Your Own Attack Only Proves the Plumbing Works
Perfect canonical counts, zero alerts across 4,727 synthetic benign records, and ten successful evasions can all be true at the same time.
The Handler Deleted the Only Field That Mattered
A synthetic cross-tenant request looked valid in telemetry. The source showed that the handler had discarded authenticated identity and trusted caller-controlled tenant selection.
How I Turned My Mom's Infected Phone Into a Cybersecurity Lab (opens in a new tab)
Isolating an adware-infected Android device, identifying the package through ADB and install timestamps, reversing the APK with APKTool and JADX, and correlating indicators through VirusTotal and OSINT. Identifiers and the sample stay redacted.
Chromium-Based Browsers: An Analysis on Simple Cache (opens in a new tab)
What Chromium's Simple Cache preserves after history is cleared: entry streams, HTTP metadata, and compressed content, plus a Python workflow that extracts, hashes, and reports findings as JSON or TSV.
Inside the Compiler: How a Sigma Rule Becomes Wazuh PCRE2 XML (opens in a new tab)
A stage-by-stage trace of one shipped rule: pySigma parsing, AST traversal, field mapping, DNF distribution, De Morgan handling, lookahead merging, and stable ID assignment.
Agentic Detection Readiness Assessment (opens in a new tab)
A sample deliverable for a fictional organization: observed MCP servers, trust boundaries, findings, detection coverage, and blind spots, written for a human reviewer. The environment and events are synthetic and labeled as such.
Approach
Methods and sources included.
Method
I separate tool output from interpretation, name what was observed, and say when the evidence cannot support attribution or a broader claim. If you cannot audit the reasoning, it is not a finding.