Software Engineer | Backend Systems & Application Security
Software engineer with a growing focus on application security, auditing code and infrastructure for real-world vulnerabilities, hardening production systems, and building tools that surface security risk before attackers do. Background spans backend API architecture, containerized deployments (Docker), CI/CD pipelines, and CMS/CRM systems built on Laravel and Livewire. Currently building OSINT and security-auditing tools (TraceTrellis, SIGIL, VaultCheck) to deepen hands-on AppSec experience alongside years of production backend engineering.
Systems Engineering & Security Case Studies
TraceTrellis
A full-stack OSINT platform that aggregates 16 data sources in parallel, breach records, domain security posture, SSL, open ports, and more.
SIGIL
A manifest-driven infrastructure hardening engine for LEMP stacks. Generates auditable, reproducible hardening scripts from a declarative YAML manifest.
VAULTCHECK
A CLI tool that audits the hygiene and risk posture of how secrets and environment variables are managed, reasoning about the full lifecycle of how secrets enter, drift, leak, and go stale.
Latest Writing
The ORM Didn't Save You: SQL Injection Through Raw Query Builder Methods in Laravel 12
Eloquent's query builder is safe, but Laravel's raw SQL escape hatches, DB::select(), DB::raw(), whereRaw(), orderByRaw(), havingRaw(), and DB::statement(), bypass parameter binding entirely. A single unauthenticated endpoint with concatenated input lets an attacker exfiltrate every table in the database using SQLMap in under two minutes.
PHP Type Juggling: Bypassing Laravel Authentication with == vs ===
PHP's == operator sees '0e830400451993494058024219903391' and '0e462097431906509019562988736854' as equal, both look like scientific notation and coerce to the float 0.0. If a stored MD5 password hash happens to start with '0e' followed only by digits, a publicly known six-character string like 'QNKCDZO' logs in as that user, no brute force required.
Areas of Proficiency
Application Engineering
Static and dynamic analysis across the PHP/Laravel stack, including type-juggling bypasses, Eloquent mass-assignment flaws, IDOR, and access-control failures. Tooling includes PHPStan/Larastan, Psalm taint analysis, and Nuclei. Direct incident response experience: detection and remediation of a production backdoor with C2 infrastructure, followed by custom file-integrity tooling and nginx hardening across multiple live sites.
Backend Engineering
A decade of production PHP and Laravel development, with Livewire for reactive interfaces. Recurring work includes custom CMS/CRM builds, authentication systems, secure API integrations, and infrastructure management across Linode VPS environments (nginx, PHP-FPM). I build with the assumption that production systems fail through chains of individually defensible decisions, not single obvious mistakes, which shapes how I approach both development and review.
