I'm a security-minded backend developer. Most of what I build lives on a trust boundary — a proxy forwarding data it never inspected, an admin panel believing a value straight from the browser — and most of what I fix upstream starts the same way: I reproduce the bug first, then write the test that proves it.
I co-founded and lead the backend at NoMansAi (Node.js, Express, Redis, n8n), and I spend the rest of my time finding real bugs in code that millions of people depend on.
12 pull requests merged into projects with 311,000+ combined stars. Each one addresses a behavioural bug and includes regression coverage.
| Project | ⭐ | What I fixed |
|---|---|---|
| TheAlgorithms/Python | 224k | Four sorting and search bugs: tree_sort dropped duplicates · stalin_sort crashed on empty input · exponential_search recursed forever · flash_sort crashed on repeats |
| faif/python-patterns | 43k | The flyweight metaclass shared one instance across different arguments |
| vadimdemedes/ink | 39k | PTY tests spawned the wrong Node executable |
| mampfes/hacs_waste_collection_schedule | 2.2k | Five scrapers repaired after providers changed their sites: Sjöbo · Lindau · RESO · CIDIU · Borlänge |
| microsoft/DevSkim | 1k | A security rule backtracked catastrophically — one 200 KB line took 51 seconds to scan. I rewrote the regex with a bounded quantifier and added a timing test. |
I fixed the actions/unpinned-tag query trusting floating tags like @v4 on
"immutable" Actions. Only full versions and commit SHAs are actually immutable —
floating tags get moved — so the query now flags the rest.
#22630, fixing
#22414.
I found CIFuzz writing its SARIF report from whatever the last fuzz target returned. In batch mode a crash found by any earlier target failed the build but reached GitHub code scanning as an empty report — a silently missed finding. #16170.
Most of these weren't reported by anyone. I went looking.
Differential fuzzing — I run reference implementations against the real ones
on random inputs. That's how I found the interpolationSearch infinite loop and
a linked-list corruption in
trekhleb/javascript-algorithms
(196k ⭐).
Measuring, not guessing — for the DevSkim ReDoS I timed the real .NET engine rather than trusting a Python regex model that over-reported it.
Cross-platform reproduction — I work on Windows, so I catch what Linux-only
CI never runs: a
TypeScript path-separator bug
in styled-components, a
missing audio codec in
Manim, a
libuv teardown crash in
Playwright, and a
packaging path that ships py.typed with no stubs
in Gradio.
I built a local, zero-trust LLM proxy. Point an OpenAI SDK, LangChain or any
HTTP client at localhost:8000/v1 instead of the provider, and every request
gets PII-scrubbed, cost-tracked, rate-limited and cached — streaming included —
whether it's headed to OpenAI, Anthropic, Gemini or a local Ollama model.
The part I care most about is the sanitizer: reversible placeholders, Luhn-validated card detection and structurally-validated SSNs, so it redacts without mangling order numbers. Nothing leaves the machine except the sanitized request.
Looking for backend or security engineering work. The fastest way to judge me is the pull request list above — open any one of them.
