Security-minded engineering: network segmentation, threat modelling, and a defensive posture built in from the first commit.

Security posture, set before launch

Leading the pre-launch security posture for a platform that will move money and host user media — threat modelling the payment and storage paths first.

• threat modelling
• Stripe Connect
• Cloudflare R2

Row-Level Security as the trust boundary

The database is the boundary, not application code: every runtime query runs through an RLS-scoped Supabase client gated by a single SQL helper, file storage enforces per-project access by parsing the object path, and Prisma is used only for schema and migrations, never at runtime.

• Row-Level Security
• PostgreSQL
• Supabase
• signed URLs

Reverse-engineering a laser rangefinder's Bluetooth protocol

Reverse-engineered the Bosch UniversalDistance 40C BLE protocol — mapping the GATT service and decoding the BLE frames — to pull laser measurements straight into the app instead of retyping them by hand.

• CoreBluetooth
• BLE / GATT
• protocol reverse-engineering

Segmentation, a DMZ, and a bastion

DMZ segmentation and a bastion host enforce a clear trust boundary between sites, with pfSense at the edge and a site-to-site VPN carrying inter-site traffic.

• pfSense
• DMZ
• bastion host
• site-to-site VPN