Loading...
Selected work
Security tooling built and shipped in the open: benchmarks for AI-written code, multi-agent review and pentesting systems, plus work contributed upstream to NVIDIA garak and Apache Airflow.
9 projects5 tools & frameworks4 upstream contributions
SAST Benchmarking Framework for Agentic Code
Open-source benchmark proving traditional SAST tools score near 0% on agentic code. 57 annotated cases across 4 languages with real CVEs, PR simulation mode, and pluggable scanner adapters, mapped to OWASP Agentic Top 10.
Multi-Agent Adversarial Security Review Tool
PyPI package with GitHub Actions integration. Uses 3 AI agents in parallel blind review with an adversarial debate engine for comprehensive code security analysis.
Agentic Pentesting Orchestrator
Meta-agent pentesting orchestrator with headless browser automation, confidence scoring, and 73% accuracy on XBOW benchmarks.
AI-Native Multi-Agent AppSec Scanner
Architecture-aware security scanner combining SAST and DAST agents with support for 11+ programming languages.
Retrieval-Augmented Security Analysis Agent
Python vulnerability analysis agent integrating static analyzers (Bandit, Semgrep) with a RAG layer to produce vulnerability reports and remediation guidelines without model fine-tuning, improving detection accuracy by 35%.
LLM Red-Teaming Framework
Contributed the BadCharacters probe to jailbreak LLMs with adversarial perturbations (zero-width spaces, homoglyphs, BiDi overrides, and backspace deletion), using differential evolution and Levenshtein distance optimization for adversarial LLM testing.
Secrets Management Platform
Identified and fixed a TOCTOU race condition in the PKI engine's ACME order finalization that could double-issue certificates, resolved by locking the finalize path (PR #32004).
Workflow Orchestration Platform
Identified and fixed SQL injection in the Hive metastore bookkeeping and Presto partition predicates via identifier allow-listing (PR #66751).
WireGuard Mesh VPN
Reported a data race and unbounded TLS certificate-chain growth in the DERP relay's per-handshake GetCertificate path (cmd/derper); maintainers confirmed and fixed it upstream in PRs #20478 and #20484.
↗ opens the repository on GitHub