Application Security Engineer | Backend Systems & Infrastructure
Application security engineer with a decade of production backend experience, auditing code and infrastructure for real-world vulnerabilities, leading incident response on live compromises, and building tools that surface security risk before attackers do. Hands-on work spans vulnerability analysis (IDOR, type juggling, mass assignment, deserialization), infrastructure hardening, and secrets/access auditing, backed by a decade of Laravel/PHP systems experience that shapes how I think about attack surface. Currently expanding that practice through OSINT and security-auditing tools (TraceTrellis, SIGIL, VaultCheck) and a running vulnerability research series (DVLA).
Security Engineering Case Studies
TraceTrellis
A full-stack OSINT platform that aggregates 16 data sources in parallel, breach records, domain security posture, SSL, open ports, and more.
SIGIL
A manifest-driven infrastructure hardening engine for LEMP stacks. Generates auditable, reproducible hardening scripts from a declarative YAML manifest.
VAULTCHECK
A CLI tool that audits the hygiene and risk posture of how secrets and environment variables are managed, reasoning about the full lifecycle of how secrets enter, drift, leak, and go stale.
Latest Writing
docker.sock Mounted in a Container: Escaping to Root on the Host via the Docker API
The container runs as root and mounts `/var/run/docker.sock`, turning Post #2 RCE into full host compromise. With no docker binary and no credentials, an attacker curls the Docker HTTP API over the Unix socket, creates a privileged container with the host root filesystem mounted at `/mnt/host`, and chroots in as `uid=0` on the host. Covers why only the root `dvla-admin` container can open the socket (the non-root `dvla-horizon` worker cannot), and the fixes: remove the mount, run non-root, use a socket proxy, or switch to rootless Docker or Podman.
Redis with No Authentication: How Your Laravel Horizon Queue Worker Becomes a Backdoor
Redis service runs with no password on the built-in default ACL user, so anyone on the internal dvla-net can RPUSH a job straight into the Horizon queue. Because Laravel's queue worker rebuilds each job with unserialize(), a phpggc gadget chain dropped into data.command executes the moment the worker pops it, no APP_KEY or admin session required. This post walks the full chain, from enumerating Redis through confirming worker-level RCE (Monolog/RCE8) and landing a reverse shell.
Areas of Proficiency
Application Engineering
Static and dynamic analysis across the PHP/Laravel stack, including type-juggling bypasses, Eloquent mass-assignment flaws, IDOR, and access-control failures. Tooling includes PHPStan/Larastan, Psalm taint analysis, and Nuclei. Direct incident response experience: detection and remediation of a production backdoor with C2 infrastructure, followed by custom file-integrity tooling and nginx hardening across multiple live sites.
Backend Engineering
A decade of production PHP and Laravel development, with Livewire for reactive interfaces. Recurring work includes custom CMS/CRM builds, authentication systems, secure API integrations, and infrastructure management across Linode VPS environments (nginx, PHP-FPM). I build with the assumption that production systems fail through chains of individually defensible decisions, not single obvious mistakes, which shapes how I approach both development and review.
