Security — Offense Informed, Defense Minded

I learned security from the offensive side — building scanners, studying XSS, auditing source for unsafe patterns — because you cannot defend a system you cannot attack. That lens now runs over everything I ship, especially agent-written code.

The toolkit

• Static analysis — my explorer project hunts vulnerable patterns and unsafe code paths in source trees.
• Web exploitation research — XSS flows, reverse-access patterns (access), bug-hunting utilities (thehunter).
• Tooling literacy — the classic collection (Collection-) every practitioner should know how to read.
• Hardening practice — token + 2FA admin panels, encrypted session vaults, minimum-surface deploys.

Security in the agentic era

Agents write more code than ever, and they write it confidently — including the insecure kind. My review checklist therefore treats every generated diff as untrusted input: injection surfaces, auth bypasses, secrets handling, dependency provenance. The method page calls this the human review step; in security terms it is the only step that matters.

Ethics clause

My offensive work targets systems I own or am authorized to test. Anything else is a crime, not a skill.