Applied mathematics. Tested code.
Maths background. I build security tools, data analysis systems, and production platforms where every claim has a number with units and a test that checks it. Information theory, statistical modeling, graph analysis - different problems, same method.
The open-source projects below cover cryptography, privacy quantification, entity resolution, and evidence fusion. The test suites verify mathematical properties, not just code paths.
I also run a production platform - three country sites on one backend, real payments through Stripe, real client data in Postgres. Scoring models, rolling-window monitoring, dispute evidence systems. Source is private; the thinking is at /writing/dispute-defense.
Stack
Each chip → project or writing where the skill is shown.
How it fits together
Featured
21 browser-only PDF tools. Nothing leaves the browser — CSP blocks all network access, three concurrent monitors feed a tamper-evident HMAC chain, and the VPE audit report is cryptographically signed. Passkey authentication, offline entitlements via ECDSA tokens.
Security scanner for business websites. Seven scanners check TLS, headers, email authentication, exposed files, third-party tracking, forms, and cookies. Every finding maps to a documented breach — 115 precedents from ICO enforcement, FBI IC3, and court filings. Industry profiles adjust severity: no DMARC on an immigration agency is critical, not just high.
Other projects
Attribution investigation. Dempster-Shafer evidence fusion, Shannon entropy anonymity quantification, Fellegi-Sunter identity correlation. Court-ready forensic reports citing 12 UK statutes. 421 tests.
Identity exposure quantification. Shannon entropy, Fellegi-Sunter record linkage, data broker supply chain as a directed graph. 303 tests.
Cryptocurrency transaction privacy. Eight attack surfaces, Dempster-Shafer evidence fusion, inverse-OSPEAD for Monero ring analysis. Started as a maths dissertation. 364 tests, 18 papers cited.
OSINT reconnaissance tool. 17 data source plugins, spectral graph clustering, Lévy stable request timing to resist statistical detection. 331 tests.
Encrypted document exchange. AES-256-GCM with HMAC key commitment (MEGA-class attack prevention), PBKDF2 passwords, AAD-bound metadata. Key in URL fragment. Nine research documents before code. 43 tests.