My work sits between software engineering, cybersecurity and connected devices. I am especially interested in systems where security is part of the architecture, not an additional layer added at the end.

I focus on:

• IoT/OT security: secure telemetry, edge gateways, MQTT, LoRaWAN and anomaly detection.
• Systems security: Rust, hardened Linux, integrity controls and applied cryptography.
• Cryptographic evidence: hash chains, Merkle transparency logs and proofs a third party can recheck.
• Application security: zero-trust authentication, MFA, passkeys, RBAC and auditability.
• Delivery: reproducible Docker environments, automated tests, CI and technical documentation.

From the sensor to the SOC: build the complete system, define the trust boundaries, observe its behaviour and prove that the controls work.

A minimal Linux distribution built from source for secure IoT/OT edge deployments.

Emberwall uses Buildroot to produce its own cross-toolchain, hardened kernel and small immutable userland. It includes sentinel, a native Rust binary that combines OT/IoT-aware TCP and UDP scanning with an Argon2id + XChaCha20-Poly1305 secrets vault.

Engineering evidence

• Hardened toolchain and kernel configuration: PIE, RELRO, SSP, FORTIFY, KASLR and LSM controls.
• Default-deny nftables policy and reduced runtime attack surface.
• OT/ICS and IoT recognition for Modbus, S7comm, IEC-104, CoAP, MQTT and LoRaWAN.
• Live ISO, workstation and locked-appliance variants for x86-64 and ARM64.
• Reproducible Buildroot packaging with vendored Rust dependencies.

Technology: Buildroot · Linux · Rust · C · nftables · MQTT · OT/ICS

Repository · Demo in GitHub viewer · Build documentation

A Rust identity provider connected to a real-time Security Operations Console.

Aegis authenticates users, evaluates risk on every request and records security events in a tamper-evident audit chain. Its React SOC console streams events live and includes a controlled attack range for demonstrating detection and response.

Engineering evidence

• RS256 access tokens, rotating refresh tokens and JTI replay detection.
• Mandatory TOTP MFA for administrators and WebAuthn/passkey authentication.
• Per-request risk scoring and GeoIP impossible-travel detection.
• Hash-chained audit events stored in PostgreSQL.
• Real-time SOC feed through PostgreSQL LISTEN/NOTIFY, SSE and WebSocket alerts.
• Ten defensive attack scenarios, run-all and storm modes.
• Docker Compose delivery behind a single-origin Caddy reverse proxy.
• Optional HashiCorp Vault dynamic database credentials.

Technology: Rust · Axum · React · PostgreSQL · Redis · Caddy · Vault

Repository · Open full demo · Walkthrough

A low-interaction IoT honeypot whose hardest requirement was not capturing attacks, but never becoming one.

Over UDP the source address is never verified, so a CoAP service that answers every request is a reflector waiting to be aimed at someone else. HoneyTrap emulates believable IoT devices, classifies the hostile traffic they attract, and decides per datagram whether replying is safe.

Engineering evidence

• Anti-amplification by design: a response-size ceiling, a per-source token bucket bounded in memory, and Proxy-Uri never honoured. The attempt is always recorded; only the reply is withheld.
• MQTT 3.1/3.1.1/5.0 and CoAP codecs as pure functions over bytes, fuzzed with 5,000 random inputs each — no exception but a malformed-packet error may escape.
• Spec violations are captured, not rejected: a strict parser would discard exactly the traffic worth studying.
• Every listener limit is a security control with a test: byte budgets, idle and session timeouts, per-IP connection caps.
• Attacker-controlled values never become InfluxDB tags — client_id as a tag is a cardinality DoS against your own database.
• Newlines are stripped rather than escaped: neither line protocol nor CEF can escape them, so one would inject a forged record.
• The attack simulator is a separate package importing nothing from the honeypot, and every scenario doubles as a CI regression test.
• CEF output on the same Emberwall schema as phosphor and maat, so a hostile session and a file-integrity alert correlate in one pane.
• Zero runtime dependencies, hash-pinned toolchain, 105 tests, mypy --strict, bandit and ruff clean.

Technology: Python · asyncio · Hexagonal architecture · MQTT · CoAP · InfluxDB · Grafana · Docker

Repository · Open full demo · Architecture

A control plane that decides who a device is and what firmware it is allowed to run.

Keystone collects no telemetry. It runs its own two-tier X.509 CA, enrols devices with single-use tokens, signs firmware artifacts and rolls updates out by cohort with rollback. The layers are separate Maven modules, so the direction of dependencies is guaranteed by the compiler rather than by discipline.

Engineering evidence

• Root + issuing CA hierarchy on EC P-256, with CSR proof-of-possession; the subject and extensions are set by the CA and never copied from the request.
• Enrolment tokens are spent by an atomic compare-and-set in PostgreSQL, so exactly one of N concurrent requests can win before any certificate is signed.
• Certificate rotation demands an ECDSA signature from the current private key over the canonical DER of the new CSR — a fingerprint is public information, not a secret.
• Real mTLS against Mosquitto: server certificate issued by the CA, require_certificate, CRL refreshed every 5 minutes and per-device-id ACLs.
• Firmware signed with Ed25519; the device id lives inside the signed manifest, so a manifest cannot be replayed onto another device.
• Cohort membership is computed, not stored: a rollout over a hundred thousand devices costs the same as one over ten.
• Hash-chained audit log with an append-only trigger in PostgreSQL, so an UPDATE is rejected by the engine.
• 78 tests: 30 domain, 5 application, 6 ArchUnit contracts and 37 integration tests against a real PostgreSQL via Testcontainers.

Technology: Java 25 · Spring Boot 4 · PostgreSQL · Bouncy Castle · MQTT/mTLS · Testcontainers · ArchUnit

Repository · Open full demo

Split a building's shared consumption, and let the tenant recompute the evidence behind their bill.

A meter reading only means something if you know who measured it, so the signature is produced on the device before anything touches the network. Every settlement interval is sealed with a Merkle root, and a tenant disputing a line recomputes it in their own browser — a proof checked by the server that issued the invoice would prove nothing.

Engineering evidence

• On-device Ed25519 signing over a canonical payload, verified against the certificate enrolled at commissioning; enrolment is a deliberate operator action, never a self-service endpoint.
• RFC 6962 append-only log: inclusion proofs say a reading is in some tree, so consistency proofs show nothing was rewritten between two heads.
• Each head is co-signed by an independent witness running outside the operator's control, and optionally anchored on chain.
• The common-area split uses largest remainder, because rounding must not create or destroy kWh.
• MySQL triggers reject UPDATE/DELETE on readings and sealed intervals: application-level append-only is not enough.
• Erasure without destroying evidence — readings are encrypted per tenant, so destroying the key erases the data while every root and proof still verifies.
• Nothing is ever edited: a bad reading is superseded by a new signed frame carrying the original's timestamp, so the energy stays in its own tariff period.
• 261 tests, 134 of them running with no database and no I/O at all; Python and TypeScript assert the same protocol vectors so the two sides cannot drift.

Technology: Python · FastAPI · Angular · MySQL · Ed25519 · RFC 6962 · Hexagonal architecture

Repository · Open full demo

Edge gateways that speak Modbus and OPC-UA, publishing to a platform that isolates each customer in the engine, not in the code.

The ingest service is an MQTT client: it never sees the certificate of the gateway that published. So every envelope is signed at the edge and verified against the certificate enrolled in PostgreSQL, which puts the broker outside the trust base — it can replay, reorder or mix messages, but it cannot forge a valid one.

Engineering evidence

• Gateway identity lives in the certificate SAN and is the only source of truth; the topic is checked against the proven identity, never the reverse.
• Topic ownership is compared segment by segment, so acme never validates a topic belonging to acme-corp.
• Replay defence on two axes: a time window on sent_at and a monotonic per-gateway sequence persisted across restarts.
• Tenant isolation by PostgreSQL Row Level Security with FORCE, so the policy applies to the table owner too. The scope is transaction-local: with a connection pool, a session-level setting would leak the previous request's tenant.
• It fails closed — with no tenant set, current_setting returns NULL, and NULL matches nothing.
• Four bounded contexts that cannot import each other, enforced by import-linter as a build-breaking contract.
• Store-and-forward SQLite buffer at the edge, drained before anything new so an intermittent link does not deliver data out of order.
• 62 tests, 2 architecture contracts, ruff, mypy --strict and bandit clean.

Technology: Python · DDD · Modbus · OPC-UA · MQTT/mTLS · PostgreSQL RLS · InfluxDB · Grafana

Repository · Open full demo

A zero-knowledge secrets manager with a Python domain core and native Rust cryptography.

The project applies domain-driven and hexagonal architecture to a security-sensitive desktop application, keeping cryptographic operations isolated behind swappable ports.

Engineering evidence

• Argon2id key derivation and XChaCha20-Poly1305 authenticated encryption.
• Rust crypto engine integrated into Python through PyO3.
• Envelope encryption and Shamir K-of-N recovery.
• TOTP, password rotation and X25519 public-key sharing with revocation.
• Tamper-evident hash-chained audit ledger with JSON, CEF and syslog export.
• Secret injection for development workflows and an auto-locking local agent.
• PySide6 desktop interface and automated tests across crypto backends.

Technology: Python · Rust · PyO3 · PySide6 · SQLite · Applied cryptography

Repository · Demo in GitHub viewer

A cross-platform Rust desktop tool for detecting filesystem tampering in real time.

Phosphor anchors a signed baseline for a directory, watches changes through native filesystem notifications and exposes modified, added or deleted files immediately.

Engineering evidence

• SHA-256 file baselines protected by HMAC-SHA256 signatures.
• Constant-time signature verification.
• Real-time filesystem monitoring and native desktop alerts.
• Gitignore-style exclusion rules and controlled re-baselining.
• JSON and CEF export for SIEM ingestion.
• Unit-tested core with no UI dependencies.

Technology: Rust · egui · SHA-256 · HMAC · SIEM

Repository · Demo in GitHub viewer

A simulation-first rural IoT security lab spanning crops, water and livestock. Each node signs telemetry with HMAC, sequence numbers and nonces. The gateway detects replay, stale, rate and physically impossible readings before trusted data reaches MQTT, InfluxDB and Grafana.

Python · Hexagonal architecture · MQTT · InfluxDB · Grafana · HMAC

Repository · SOC demo

A multi-sensor edge architecture combining air quality, mmWave presence, acoustic TinyML and vision. Raw audio and images remain at the edge; only classifications and trusted observations enter the telemetry pipeline.

ESP32-S3 · Edge ML · Python · MQTT · Node-RED · Grafana

Repository · Dashboard demo

A simulation-first, solar-powered weather station with coherent virtual sensors, battery behaviour and environmental events. Its hexagonal core is prepared for a future ESP32 and LoRa hardware adapter without rewriting the domain model.

Python · ESP32-ready · LoRa · MQTT · Node-RED · InfluxDB · Grafana

Repository · Demo

• Maat — Rust modal editor with SHA-256 integrity tracking, atomic saves, external-change detection and SIEM audit output. · Demo
• Pyscan — asynchronous network and OT-protocol scanner with host discovery, fingerprinting and structured output. · Demo
• Auth-Lab — NestJS zero-trust authentication lab with MFA, replay defence, risk analysis and a controlled attack simulator. · Demo
• Arch Linux Hardened Server — documented Linux hardening and attack-surface reduction.

• Toychain — Rails 8 tamper-evident blockchain with background proof-of-work, authenticated real-time updates and an independent Python verifier. · Demo
• Crypto·Watch — Rust/Axum WebSocket backend, Astro/React frontend, PostgreSQL persistence and Docker delivery. · Demo
• QuantLab — DDD and hexagonal backtesting engine with order execution, OCO controls, walk-forward analysis and performance metrics.
• Elitewear XI — Laravel 13 ecommerce with PayPal checkout and a versioned REST API, built with application security as the design constraint: IDOR prevention, row-level locking against stock and coupon oversell, strict CSP without inline scripts and a tamper-evident audit log. The test suite verifies that the attacks fail.

• API IoT — ESP32 and DHT22 telemetry over MQTT to a Node.js backend and React dashboard.
• Eastron LoRaWAN Energy Monitoring — electrical-energy telemetry with LoRaWAN, InfluxDB and Grafana.
• SmartWatch LoRaWAN — wearable sensing and remote monitoring over LoRaWAN.
• Snake HD — polished Pygame project with a tamper-evident leaderboard backed by Rust/Axum. · Demo

Build complete systems, not disconnected scripts.
Treat security as an architectural requirement.
Keep the domain independent from infrastructure.
Make behaviour observable.
Test the trust boundaries.
Document how another engineer can run the project.
Ship a working demonstration.