Application Security Engineer | Backend Systems & Infrastructure
Application security engineer with a decade of production backend experience, auditing code and infrastructure for real-world vulnerabilities, leading incident response on live compromises, and building tools that surface security risk before attackers do. Hands-on work spans vulnerability analysis (IDOR, type juggling, mass assignment, deserialization), infrastructure hardening, and secrets/access auditing, backed by a decade of Laravel/PHP systems experience that shapes how I think about attack surface. Currently expanding that practice through OSINT and security-auditing tools (TraceTrellis, SIGIL, VaultCheck) and a running vulnerability research series (DVLA).
Security Engineering Case Studies
TraceTrellis
A full-stack OSINT platform that aggregates 16 data sources in parallel, breach records, domain security posture, SSL, open ports, and more.
SIGIL
A manifest-driven infrastructure hardening engine for LEMP stacks. Generates auditable, reproducible hardening scripts from a declarative YAML manifest.
VAULTCHECK
A CLI tool that audits the hygiene and risk posture of how secrets and environment variables are managed, reasoning about the full lifecycle of how secrets enter, drift, leak, and go stale.
Latest Writing
PHP2Shell Internals: From a Half-Written Bucket to system()
The engine-level follow-up to the PHP2Shell story. It walks the half-written bucket in CVE-2026-109618, the forged zend_string that leaks 800 KB of worker memory, and the fake zend_reference and zend_array that turn array cleanup into a call to zif_system(). Includes the struct layouts, offsets, and full destructor chain.
Areas of Proficiency
Application Engineering
Static and dynamic analysis across the PHP/Laravel stack, including type-juggling bypasses, Eloquent mass-assignment flaws, IDOR, and access-control failures. Tooling includes PHPStan/Larastan, Psalm taint analysis, and Nuclei. Direct incident response experience: detection and remediation of a production backdoor with C2 infrastructure, followed by custom file-integrity tooling and nginx hardening across multiple live sites.
Backend Engineering
A decade of production PHP and Laravel development, with Livewire for reactive interfaces. Recurring work includes custom CMS/CRM builds, authentication systems, secure API integrations, and infrastructure management across Linode VPS environments (nginx, PHP-FPM). I build with the assumption that production systems fail through chains of individually defensible decisions, not single obvious mistakes, which shapes how I approach both development and review.
