Security work / Production systems, application security, personal privacy
Security Engineering
Professional security systems, application security, and the tools I make to protect my own data and devices. Work for employers is intentionally generalized to protect company systems and configuration.
About these case studies
Professional work here covers security systems I built or helped implement for real operations. My own software and academic labs sit in separate sections, with public links where available. A production system, a code review, and a consumer privacy tool show different kinds of work; none should be mistaken for the others.
Production · Identity & access
01 · Access governance
Self-service access with controlled provisioning
A Slack-based access platform that turns fragmented requests into configurable, auditable workflows across dozens of applications.
Internal production system
Problem
Application access was distributed across informal messages, manual follow-up, and inconsistent provisioning paths.
One onboarding engine instead of another pile of scripts
Onboarding touched enough systems that copying the same logic between scripts stopped making sense. I moved the shared work into a reusable engine and kept the operator-facing workflow small.
Internal platform
System
Shared onboarding engine used by multiple entry points
Structured intake for otherwise messy HR data
Provisioning across communication and directory tools
Safety design
Dry-run-first writes
Credentials stored outside the application
Approved-device checks
Append-only action logging
Engineering
Integration tests around shared behavior
Reusable logic instead of copied call sites
Clear separation between parsing, decisions, and writes
A scheduled state machine moves accounts through onboarding, first sign-in, active use, and departure while keeping destructive actions visible and controlled.
Live automation
Lifecycle engine
Routes new accounts through controlled states
Moves active users from validated directory attributes
Handles termination cleanup
Boundaries
Protected service and guest accounts
Explicit state precedence
Human gates around destructive changes
Operations
Idempotent scheduled scans
Dry-run controls
Action logs and daily reporting
Google Apps Script · Admin SDK · Google Workspace · Scheduled controls
04 · Deactivation reconciliation
A second system that checks the first one
Automation can fail quietly. This read-only control compares deactivated accounts across identity, email, and collaboration systems and reports exactly where the records disagree.
Detective control
Checks
Cross-system account-state comparison
Itemized discrepancies rather than a pass/fail total
Scheduled review outside the lifecycle workflow
Deliberate limitation
Read-only by design
No automatic remediation
Dedicated minimal-permission identity
Why separate it?
The control should still be useful when the automation it checks is wrong. Sharing write behavior would defeat the point.
Okta · Google Workspace · Slack · Read-only reconciliation
05 · Secure administration
A small interface for high-impact directory work
A packaged macOS tool for reviewing directory gaps, previewing Gmail signatures, applying approved changes, and exporting audit results.
Internal application
Capabilities
Directory data-quality review
Signature preview and application
Administrative CSV exports
Access model
Approved-device restriction
Secrets excluded from source control
Configuration separated from application code
Operator safeguards
Preview before apply
Scoped bulk selection
Launch and write-event auditing
Python · Flask · Gmail API · Google Directory API · PyInstaller
Production · Email & endpoint
06 · Email security
Directory synchronization with conservative boundaries
This automation keeps directory names and aliases synchronized with Proofpoint. Safe updates are automatic; onboarding and offboarding remain human-reviewed.
Live automation
Automated
Additive directory updates
Alias and display-name consistency
Scheduled reporting
Human-reviewed
Onboarding and offboarding actions
Ambiguous account changes
Protected account types
Design
Additive and reversible defaults
Least-privilege scopes
Hosted job with a local TypeScript twin
Proofpoint APIs · Google Workspace · Google Apps Script · TypeScript
07 · Endpoint security
Finding the gap between “installed” and healthy
I worked across endpoint-security and device-management data to find unhealthy installations, reconcile mismatched inventory, and improve fleet visibility.
Fleet automation
Investigation
Separated stale records from unhealthy installations
Identified missing endpoint permissions
Tracked devices invisible to one side of the inventory
A reconciliation uncovered that vendor and agreement records were living in too many places. I designed a normalized system that keeps the source record, review status, and downstream compliance views connected.
System design
Problem
Vendor data split across separate trackers
Agreement status difficult to verify
Downstream lists drifting from source records
Model
Normalized vendor and agreement records
Explicit ownership and review status
Linked evidence rather than duplicated fields
Use
Live downstream compliance views
Clear gaps without publishing internal vendor data
A system people can maintain without a separate platform
Two kinds of evidence: reviewing software I built and working through intentionally vulnerable code in a university course. Neither should be confused with the sanitized professional systems above.
Public app · Private source · Security review in progress
Pet Sticker Maker: Security Case Study
What happens when a fun pet-photo tool accepts untrusted images and processes them on a server?
I walk through the React/FastAPI architecture, upload boundary, automated tests, current GitHub Actions CI, and where I still need to harden it. Implemented safeguards and proposed changes are separated clearly.
Projects for reducing personal data exposure and blocking trackers without outsourcing the entire problem to another subscription service.
Live · Public Source
No More Data Brokers
Privacy · Client-side · Local-only
Privacy rights should not require paying a subscription to the same ecosystem that profits from personal data.
A free browser-based tool for working through data-broker opt-outs, generating privacy-request templates, prioritizing removals, and tracking when listings should be checked again. Profile and removal state stay in the browser.
Raspberry Pi + AdGuard Home · DNS · Network privacy
I wanted tracker and ad blocking at the network level, where every device on my Wi-Fi could benefit without installing a separate blocker.
A Raspberry Pi 4B running AdGuard Home as network DNS filtering, with router/DHCP configuration, tuned upstream DNS, allowlisting for services that need to keep working, and targeted blocking for ad- and telemetry-heavy devices.
Planned expansion: securely route my phone back through this DNS service while away from home so the same filtering follows me on cellular and other Wi-Fi networks.
I wanted to get rid of ads across my network and learn more about managing my own infrastructure.
This project documents my Raspberry Pi and AdGuard Home setup, the mistakes I made along the way, and the lessons learned getting everything working correctly.
Planned expansion: route my phone back through the home AdGuard instance when I am away from Wi-Fi so the same DNS filtering can block ads and trackers on the go.
Architecture principles
Patterns shared across the systems
Safe defaults
Potentially destructive writes begin disabled or dry-run and require deliberate enablement.
Least privilege
Read-only jobs use read-only service identities rather than inheriting broader administrative scopes.
Human control
Automation handles repeatable work while preserving review for privileged, ambiguous, or destructive actions.
Idempotency
Scheduled jobs can run repeatedly without reapplying settled state or creating duplicate side effects.
Observability
Actions, failures, pending work, and cross-system inconsistencies are surfaced in useful operational summaries.
Usable security
Controls are embedded into tools employees and administrators can actually use, rather than added as separate friction.