Code by language
Hover
- TypeScript46.9 %
- JavaScript41.1 %
- TeX4.7 %
- Python3.8 %
- Shell0.8 %
- PLpgSQL0.7 %
- C#0.7 %
- CSS0.6 %
GitHub engineering activity
Commits over the last 90 days
HOVER A POINT FOR DETAILS20 Jul31 Aug12 Oct
Repositories by technology
Hover
- JavaScript28 repos
- Node.js28 repos
- CSS24 repos
- React24 repos
- TypeScript24 repos
- Tailwind CSS18 repos
- HTML15 repos
- Next.js12 repos
Recent commits by scope
Hover
- Private personal work13 commits
- Public personal work103 commits
CURRENT DIRECTIVE
Enterprise Focus
Lerøy Seafood Group
Leading Architecture, Security & AI
Orchestrating adaptive, highly scalable, and cyber-secured systems across Python, Node.js, Rust, Java, SQL/PostgreSQL, Redis, and Agentic AI workflows. Driving Zero-Trust security, cloud native microservices, and long-term maintainability.
SYSTEM TENETS
Core Philosophies
Latest writing
Browse all postsField notes
AppSec Lead Brief: recheck JWT and agent execution boundaries
JWT verification failures, Docling local-file disclosure, vm2 sandbox breaks, and Dependency-Track 5.2 identity improvements.
Read noteAppSec Lead Brief: check your cache and sandbox boundaries
Next.js patches, a critical Wasmtime sandbox flaw, and practical checks for tenant isolation and developer tooling.
Read noteAppSec Lead Brief: patch Next.js image routes and recheck build trust
This week's engineering priorities: Next.js image-generation exposure, TeamCity ransomware, device-code phishing and Rust parser updates.
Read noteAppSec Lead Brief: an exploited identity API and two Rust cryptography checks
Cisco ISE exploitation makes identity infrastructure the immediate priority, while two Rust advisories require configuration-aware dependency checks.
Read noteAppSec Lead Brief: Artifactory token flaws turn patching into incident response
Two additional Artifactory token flaws are now confirmed exploited, while a malicious Rust crate shows why developer workstations belong inside the software supply-chain threat model.
Read noteThe API Knew Who I Was, but Not What I Was Allowed to Touch
A practical AppSec story about broken object-level authorization, tenant isolation, Microsoft Entra ID, FastAPI, Rust, PostgreSQL, and the evidence a secure API should leave behind.
Read note