Application Security Engineer | Backend Systems & Infrastructure
Application security engineer with a decade of production backend experience, auditing code and infrastructure for real-world vulnerabilities, leading incident response on live compromises, and building tools that surface security risk before attackers do. Hands-on work spans vulnerability analysis (IDOR, type juggling, mass assignment, deserialization), infrastructure hardening, and secrets/access auditing, backed by a decade of Laravel/PHP systems experience that shapes how I think about attack surface. Currently expanding that practice through OSINT and security-auditing tools (TraceTrellis, SIGIL, VaultCheck) and a running vulnerability research series (DVLA).
Security Engineering Case Studies
TraceTrellis
A full-stack OSINT platform that aggregates 16 data sources in parallel, breach records, domain security posture, SSL, open ports, and more.
SIGIL
A manifest-driven infrastructure hardening engine for LEMP stacks. Generates auditable, reproducible hardening scripts from a declarative YAML manifest.
VAULTCHECK
A CLI tool that audits the hygiene and risk posture of how secrets and environment variables are managed, reasoning about the full lifecycle of how secrets enter, drift, leak, and go stale.
Latest Writing
Redis with No Authentication: How Your Laravel Horizon Queue Worker Becomes a Backdoor
Redis service runs with no password on the built-in default ACL user, so anyone on the internal dvla-net can RPUSH a job straight into the Horizon queue. Because Laravel's queue worker rebuilds each job with unserialize(), a phpggc gadget chain dropped into data.command executes the moment the worker pops it, no APP_KEY or admin session required. This post walks the full chain, from enumerating Redis through confirming worker-level RCE (Monolog/RCE8) and landing a reverse shell.
SSRF in Laravel: How a 'Fetch Banner from URL' Feature Bridges Into the Internal Network
A blog editor's 'fetch banner from a URL' shortcut calls Http::get() on whatever you type, with no scheme, host, or IP checks, so an admin session becomes a free port scanner for the internal Docker network. Each error that comes back is an oracle: an empty reply means Redis, a refused connection means a closed port, and a clean 200 means you can read whatever's on the other end. Pair it with Post 1's mass-assignment bug and Redis is one polite form field away, no shell required.
Areas of Proficiency
Application Engineering
Static and dynamic analysis across the PHP/Laravel stack, including type-juggling bypasses, Eloquent mass-assignment flaws, IDOR, and access-control failures. Tooling includes PHPStan/Larastan, Psalm taint analysis, and Nuclei. Direct incident response experience: detection and remediation of a production backdoor with C2 infrastructure, followed by custom file-integrity tooling and nginx hardening across multiple live sites.
Backend Engineering
A decade of production PHP and Laravel development, with Livewire for reactive interfaces. Recurring work includes custom CMS/CRM builds, authentication systems, secure API integrations, and infrastructure management across Linode VPS environments (nginx, PHP-FPM). I build with the assumption that production systems fail through chains of individually defensible decisions, not single obvious mistakes, which shapes how I approach both development and review.
