Application and infrastructure security, learned hands-on: write the vulnerable version, exploit it, fix it,
then prove the same attack no longer works. Everything I build for that is open source and runs locally.
Twelve labs from SQL injection and XSS to JWT forgery and race conditions. Each runs the vulnerable code and its fix side by side, shows the diff, and checks on the server that your attack lands on one and fails on the other. |
Import OpenAPI or Postman, add test accounts, say who owns which objects. AuthScope compares real responses with
your policy, so |
Reads Docker Compose, Kubernetes and Terraform plans offline and builds a graph of who can reach what. It shows how an exposed pod, a mounted token and a broad role add up to a path to your secrets, traces every step to a line of config, and simulates which fix breaks the most chains before you touch a file. |
Tests the whole agent, not just the model: which tools it calls, which data it touches, whose instruction it follows. It replays prompt injection, memory poisoning and data leaks against sandbox agents with mock tools, records the full trace, and shows the same attack recorded in Monitor mode and blocked in Enforce mode. |
Reads lockfiles and SBOMs without ever running them, builds the real dependency graph and matches every resolved package against OSV advisories. Each finding shows the path that brought the package in and the lockfile line behind every hop. A package that was not evaluated is never reported as clean, and a what-if mode compares an upgrade before you touch a file. |
Turns "tenant A must not see tenant B" into real SQL run as each role inside a throwaway PostgreSQL, and records what the database actually did: which gate stopped it, which policies applied, and why. Anything it cannot prove stays inconclusive, never "safe". A live database is only ever read, a what-if lab replays a policy change before you ship it, and a generated schema of 1 000 tables and 10 000 policies runs end to end in under 30 seconds. |
Code: in WebSec-Lab you write the bug, exploit it and watch the fix refuse the same request.
API: AuthScope finds the same class of bugs in a running service, using your access policy as the oracle.
Infrastructure: CloudGraph shows how the platform around the service turns one bug into a path to the crown jewels, and which change cuts it.
AI agents: AgentShield checks what an agent with tools and memory actually does when untrusted text tells it to misbehave.
Supply chain: SupplyChain Radar shows how a vulnerable dependency got into the project, through which parent, and which upgrade really removes it.
Database: RLS Sentinel tests whether PostgreSQL row-level security keeps every tenant in its own rows, role by role and command by command.
All six report evidence rather than guesses, separate "proven" from "possible", and ship a vulnerable and a hardened version so the tests can show both.
See them in action
WebSec-Lab: Alice reads Bob's booking in the vulnerable mode; in the fixed mode the same request is refused.
AuthScope: a run against the demo API, the permission matrix, and the evidence for one finding.
CloudGraph: attack paths in an insecure cluster, one highlighted in the graph, a what-if fix that removes four, and a diff against the hardened version.
AgentShield: one prompt injection recorded in Monitor mode and blocked in Enforce mode, then the agent trace and a before/after comparison.
SupplyChain Radar: every path from the app to a vulnerable shared dependency highlighted in the graph, then the finding with its evidence and the upgrade that fixes it. Demo data is synthetic and labelled as such.
RLS Sentinel: the vulnerable fixture finds 8 cross-tenant leaks, the evidence for one shows which gate let it through, a what-if fix removes two in a sandbox without regressions, and the secure variant finds none. All data is synthetic.
Web pentesting with the OWASP Web Security Testing Guide
Access control and authentication flaws in APIs (OWASP API Security Top 10:2023)
Kubernetes and cloud attack paths: RBAC, NetworkPolicy, IAM (RBAC good practices)
Security of LLM apps and AI agents (OWASP GenAI Security Project: LLM and Agentic Top 10)
Fixes that hold, and tests that prove they do