Independent security research on operating systems, kernels and the boundaries that keep software isolated, reproducible and trustworthy, plus web and AI security. Latest note · 2026-10-03 Routing filters decide which requests reach a handler, not who may use it. Coordinated disclosure Encrypted reports welcome. Acknowledgement within 3 business days, 90-day default disclosure window, nothing published until it is fixed.I test the boundaries your systems trust.
A matcher is not a security boundary
Found something? Report it privately.
Independent security researcher specialising in reproducible, isolated and security-boundary systems. Founder @SouverainLabs.
Every finding is documented with a threat model, a disclosure timeline and a mitigation, because good researchers don't just break things, they explain why.
Read my storyWhere to start
pick your pathSee the work
Resume, SOC and IAM case studies, and the certifications and badges behind them.
resume → 02 · researchingRead the research
Findings with a threat model, timeline and mitigation, plus detection rules and the isolated lab they are reproduced in.
findings → 03 · reporting a bugReport a vulnerability
Send a minimal reproduction, encrypted if sensitive. Acknowledgement within three business days.
disclosure policy →Selected work
one of eachNext.js middleware matcher leaves admin API routes unauthenticated
Authentication enforced only in middleware, and the matcher covers the admin pages but not the admin API.
read the finding → Detection · Splunk SPLBurst of failed SSH logins followed by a success
Counts failed and accepted password logins per source to surface a guess that finally worked.
read the detection → Case study · incident responseCI token exposure and a tampered build artifact
A leaked service token used to publish a tampered build. Timeline, role, actions and improvements.
read the case study →Beyond the core
web security · AI security · workflow tooling · linux customizationWeb Security Research
Application and API security on modern stacks such as Next.js: authentication and access control, SSRF, injection and framework-specific flaws.
02AI Security Research
LLMs, agents and the infrastructure under them: prompt and tool-output injection, trust propagation in multi-agent systems, unsafe model loading.
03Workflow Tooling
Building my own tools to make research repeatable: triage, reproduction and reporting.
04Linux Customization
Bending the desktop to fit the work: a tiling Wayland compositor, terminal-first tooling and reproducible, declarative system configuration.
Working toward the Cisco Network Security, Cisco Endpoint Security, TryHackMe Pre-Security and TryHackMe Security Engineer certifications and badges, and growing the detection library.
See /now