I research emerging threats and build open-source defenses for AI agents, the software they write, and the tools they trust.
Software engineer, security researcher, and open-source maintainer.
Leading Developer Relations at Snyk.
My work spans AI agents, developer tooling, and software supply chain security: co-authored papers, vulnerability disclosures, patents, and research that became practical defenses.
An evaluation of deterministic SAST and AI security agents on 108 vulnerabilities across 20 open-source applications, examining coverage, harness policy, and cost. Snyk Code and Claude Code’s strongest evaluated configuration together covered 101 of 108 vulnerabilities.
A benchmark of 307 dependency upgrades across 43 repositories, evaluating whether AI agents fix vulnerabilities while preserving successful builds and tests.
Lint lockfiles for trusted registries and protect against lockfile injection.
Check package health and security signals before installing npm dependencies.
A practical guide to building thoughtful, accessible, and reliable command-line applications.
Articles on security, developer tooling, and what I’m building.
Build a private, mobile-first Hermes Agent using Matrix Synapse, Element, end-to-end encryption, Tailscale Serve, and separate Proxmox LXC containers.
A hands-on guide to the files, schemas, workflows, governance, and maintenance routines behind an AI-assisted second brain.
How a plain-Markdown knowledge graph becomes a durable context layer, operating system, and compounding productivity tool for AI-assisted work.
Plenty of live hacking. I bring real-world attacks and practical defenses to conferences, meetups, and workshops. AI security, Node.js, and the software supply chain, explained through code.
5 selected maintained packages
6 featured repositories
6 featured repositories
Sep 17, 2026 – Oct 16, 2026. Package downloads, not unique developers; totals include dependency installs.
GitHub snapshot: Oct 20, 2026. Stars and forks across the six featured repositories, not unique people or all my projects.
Lint lockfiles for trusted registries and protect against lockfile injection.
Check package health and security signals before installing npm dependencies.
An interactive terminal interface for managing Docker containers and services.
Detect bidirectional Unicode characters used to disguise malicious source code.
A practical guide to building thoughtful, accessible, and reliable command-line applications.
Security resources, tools, and learning material for the Node.js ecosystem.
Practical guides built around real vulnerabilities, with code to break, fixes to understand, and techniques to take back to your own projects.
From the community
“Some people talk about AppSec (me) and some people really dig in and do the work (you). I’m a big fan.”
“FANTASTIC WORKSHOP! Learned a ton! Thanks a lot 🙏”
“This has become my primary source for learning docker with node. Thanks for sharing these 💝”
“This is one of the best guides I’ve seen on this topic, really cool stuff.”
