David
Builds & Breaks

IDOR/BOLA review that runs itself, on Claude agents

An automated pentest of authorization logic in Next.js App Router repos. Agents follow every client-controlled identifier to the database query it reaches and flag the ownership checks nobody wrote. It is the top OWASP risk, and pattern-matching SAST mostly cannot see it.

• → Four phases: a deterministic endpoint inventory with ts-morph (route handlers, Server Actions, auth-library detection), an agent trace pass, an adversarial verify pass whose whole job is killing false positives, and reports in Markdown, SARIF or JSON with exit codes CI can gate on.
• → The accuracy is a number, not a feeling: a seeded benchmark of 16 IDOR/BOLA bugs plus 6 correctly written twins as false-positive traps, recall and precision gates, and an oracle runner that proves the harness scores right regardless of how good the model is.
• → It fails loudly. An endpoint it could not analyze is reported as not analyzed, never as clean, and a candidate it cannot confirm comes back as low confidence instead of quietly disappearing.

Secure real-time collaborative workspace

A collaborative workspace where I wrote the identity and auth layer myself instead of importing one, plus a realtime layer built to match it.

• → Auth built in-house: EdDSA JWTs, rotating refresh tokens that detect reuse, Argon2id hashing, CSRF protection.
• → My own WebSocket server. The handshake uses a single-use ticket, every event is authorized on its own, and RBAC is checked server-side.
• → Rooms carry presence, typing indicators, shared threaded context, and history that survives a reconnect.

A JWT lab with a broken half and a fixed half

Two versions of the same API, one vulnerable and one hardened. Every attack lands on the first and bounces off the second, so you can run the fixes instead of taking my word for them.

• → JWT signing and verification written from scratch in TypeScript, no libraries, reproducing five flaws that reach production: alg=none bypass, HS256/RS256 key confusion, weak-secret brute force, kid header injection, and missing iss/aud/exp validation.
• → Exploit scripts in Bash and OpenSSL, plus a harness that runs every payload against both APIs and checks the result each way.
• → The hardened service removes whole classes of bug at once: one allowed algorithm (RS256), a fixed in-memory kid registry with rotation, generic errors, and scrypt for passwords.

LLM/RAG security lab, attack side and defense side

Two FastAPI services with the same RAG surface: one left vulnerable on purpose, one hardened. Every attack in the suite works on the first and fails on the second.

• → Five OWASP LLM Top 10 scenarios written as a pytest attack suite: cross-tenant retrieval leak (confused deputy), indirect prompt injection through retrieved documents, vector-store poisoning via forged ingest metadata, excessive agency over a real MCP tool server, and stored XSS coming straight out of the model.
• → The RAG pipeline is hand-built (embeddings, in-memory vector store, multi-tenant ACL corpus) with no LangChain, so the diff between the two apps is the security decisions and nothing else.
• → A deterministic mock LLM turns "every attack fails against the secure API" into something CI can rely on, and an OpenRouter provider re-runs the injection tests against a real model.

Playable, sandboxed web-security CTF

A hacking terminal you can actually type into. Four boxes, four real vulnerability classes, all simulated in the browser: no network calls, no eval.

• → Four exploit paths: SQLi auth bypass, IDOR, a JWT alg=none signature strip, and reflected XSS, each matched against a fake target.
• → The whole terminal: a command interpreter with history, a typewriter boot sequence, matrix rain on a canvas, CRT scanlines, and flags to capture in order.
• → Same attack classes I defend against in the JWT Security Lab and jwt-scan.

Solo-built e-commerce platform, live in production

A live storefront for a family-owned hardware retailer. Real customers, real payments, and nobody else to call when it breaks.

• → I was the only engineer on it: requirements, architecture, the real-time inventory catalog, deployment, and the maintenance it still gets.
• → Built the authentication, session security and RBAC that keep the staff side separate from the customer side, and wired up Mercado Pago for live transactions.
• → Hardened the application layer against the OWASP Top 10: parameterized queries, input validated on the server, CSRF protection on anything that changes state, and database roles with the least privilege that still works.