Security / AI
Learning how systems fail, then testing carefully.
My research interests build on my software engineering work: understanding API behavior, access controls, and the boundaries between user input and trusted systems.
API and access-control testing
I build tooling and use controlled role comparisons to investigate authorization behavior, object access, and business logic in authorized environments. A test observation is a lead; a finding requires a demonstrated effect and a clear permission contract.
Some research tooling and target details are private. I publish only material that is appropriate to share.
Hands-on AI security learning
I'm working through the AI Red Team Academy modules and labs, with attention to the behavior of applications that combine models, tools, retrieval, and external data. This is ongoing learning and lab work.
View my AIRT fork ↗How I communicate research
I separate a hypothesis, an observed response, and a confirmed impact. That distinction matters when describing both security testing and AI evaluations.
Contact me about research ↗