David
Builds & Breaks

Autonomous IDOR/BOLA review, driven by Claude agents

An autonomous pentest of authorization logic in Next.js App Router repos: agents trace each client-controlled identifier to the database query it reaches and flag the ownership checks that are missing — the #1 OWASP risk that pattern-matching SAST largely misses.

• → Four-phase pipeline: deterministic endpoint inventory with ts-morph (route handlers, Server Actions, auth-library detection), an agent trace pass, an adversarial verify pass that kills false positives, and Markdown / SARIF / JSON reports with CI-ready exit codes.
• → Measured, not vibes: evaluated on a seeded benchmark of 16 IDOR/BOLA vulnerabilities plus 6 hardened twins as false-positive tripwires, with recall/precision gates and an oracle runner that validates the harness independently of model quality.
• → Degrades loudly, never silently: endpoints that can’t be analyzed are reported as not-analyzed rather than clean, and unverifiable candidates surface as low-confidence instead of being dropped.

Offense-and-defense LLM/RAG security lab

Two FastAPI services with the same RAG surface — one intentionally vulnerable, one hardened. Every attack in the suite succeeds against the first and fails against the second, so each fix is demonstrated rather than claimed.

• → Five OWASP LLM Top 10 scenarios as an executable pytest attack suite: cross-tenant retrieval leak (confused deputy), indirect prompt injection via retrieved documents, vector-store poisoning through forged ingest metadata, excessive agency over a real MCP tool server, and stored XSS from model output.
• → RAG pipeline built by hand — embeddings, in-memory vector store, multi-tenant ACL corpus — no LangChain, so the diff between the two apps is exactly the set of security decisions.
• → A deterministic mock LLM makes “every attack fails against the secure API” a reliable CI property; an OpenRouter-backed provider re-checks injection behavior against a real model.

Offense-and-defense JWT vulnerability lab

Offense-and-defense lab exercising real-world JWT vulnerabilities against a hardened mirror, proving each fix rather than claiming it.

• → From-scratch JWT sign/verify in TypeScript (no libraries) reproducing five production-grade flaws: alg=none bypass, HS256/RS256 key confusion, weak-secret brute-force, kid header injection, and missing iss/aud/exp validation.
• → Reproducible exploit scripts (Bash + OpenSSL) and a harness that proves each payload succeeds against the vulnerable API and is rejected by the secure one.
• → Hardened service eliminates entire bug classes: single-algorithm RS256 allowlist, fixed in-memory kid registry with rotation, generic errors, and scrypt password hashing.

Secure real-time collaborative workspace

Secure collaborative system with verified identity, hardened authentication, and a purpose-built realtime layer.

• → In-house auth stack: EdDSA JWTs, rotating refresh tokens with reuse detection, Argon2id hashing, CSRF protection.
• → Custom WebSocket server with single-use ticket handshake, per-event authorization, and RBAC enforced server-side.
• → Realtime room layer: presence, typing, shared threaded context, and persistent history that survives reconnects.

Solo-built, in-production e-commerce platform

Solo-built, in-production e-commerce platform for a family-owned hardware retailer.

• → Sole engineer end-to-end: requirements, architecture, real-time inventory catalog, deployment, and ongoing maintenance for a live retail storefront.
• → Designed and shipped authentication, session security, and RBAC for staff vs. customer surfaces; integrated Mercado Pago for live online transactions.
• → Hardened the application layer against OWASP Top 10 risks: parameterized queries, server-side input validation, CSRF protection on state-changing endpoints, and least-privilege database roles.