Independent projects

Meet Privacy Guardian

Meeting privacy, with consent.

A dashboard and Chrome extension for Google Meet, with local visual reference-image comparison, reviewable alerts and privacy controls.

Visual comparison does not identify glasses models or prove recording. Validation in a real meeting remains pending.

Public access: explore the dashboard and download the Chrome extension. Analysis requires participants’ consent.

Code Provenance Guardian

Code provenance before and after the LLM.

A pipeline step with a Python CLI, model-transfer policy and matching against an indexed public corpus. PASS, BLOCK or REVIEW decisions backed by repository, commit and content evidence.

Includes a scenario simulator and GitHub Actions reference. Local tests use a mocked API; live integration is pending. Does not certify authorship or usage rights.

Public access: explore the lab and download the CLI and pipeline example.

CVE Hunter

Vulnerabilities, evidence and coordinated disclosure.

An independent research initiative for open-source applications and libraries, combining AI-assisted analysis, static review of public source code and mandatory human review.

The portal brings together research history and selected public advisories while preserving confidential details during triage. Candidates and research credits are distinct from officially assigned CVEs.

The documented research was static, with no project execution or testing of online installations. External disclosure is not automatic.

Agentes de Segurança

Security assessments, evidence and decisions in one console.

A cybersecurity platform with an agent catalog for CSPM, AWS SOC observations, authorized DAST, architecture, FinOps, SEO and availability. Multicloud coverage depends on the agent, plan and effective permissions.

An authenticated console with findings, history, reports, account isolation, Google OAuth, an optional second factor through Authenticator or FIDO2/WebAuthn, and MCP/OAuth integration with ChatGPT.

Assessments depend on authorized scope and configured integrations. Baselines do not replace human review or a full penetration test; agents do not apply cloud remediation.

Cloud Guardrail Assurance

Local checks of S3, RDS and CloudTrail controls in Terraform plans. Includes denial, unknown-value and control-deletion scenarios; does not assess a live AWS account or complete SCP behavior.

Consolidates professional experience themes. First demonstrable edition: November 2026. Includes code, local tests, decisions, threat model and runbook.

Initial version with private owner access; live service validation pending.

MCP Authorization Security Lab

Offline lab for audience, scopes, expiration, revocation, tenant isolation and one-time tool approval. Uses synthetic capabilities; it is not a production MCP/OAuth server.

Consolidates professional experience themes. First demonstrable edition: November 2026. Includes code, local tests, decisions, threat model and runbook.

Initial version with private owner access; live service validation pending.

Security Architecture Decision Lab

Fictional booking-platform case with trust boundaries, flows, architectural decisions, alternatives and risk ownership. The checker evaluates document completeness, not control effectiveness.

Consolidates professional experience themes. First demonstrable edition: November 2026. Includes code, local tests, decisions, threat model and runbook.

Initial version with private owner access; live service validation pending.

Security Resilience Lab

Local tests for circuit breakers, retry budgets and integrity-checked restoration. Injected failures and synthetic data; no production RTO/RPO measurement.

Consolidates professional experience themes. First demonstrable edition: November 2026. Includes code, local tests, decisions, threat model and runbook.

Initial version with private owner access; live service validation pending.