Zion Click Create
Book a call

Zion Click Create / AI + IT consulting / Scottsdale, AZ

Built.Secured.Proven.

▸ AI agents / automation / websites / security and IT

I'm Zion Boggan. I build AI agents, websites and IT systems for businesses, and I lock them down like a security analyst, because that is my day job.

Book a call Check my credentials
● SCOTTSDALE, AZ 00:00:00 MST 4 CERTIFICATIONS 4 LIVE SITES SHIPPED 31 FINDINGS DISCLOSED TO VENDORS

01 / Due diligence

The 10‑second check.

Before you hire anyone, you should be able to check them. Here is everything I would want to see, with the evidence one click away.

01 A real person Zion Boggan, Scottsdale, AZ. Same name, same face, on every profile.LinkedIn / GitHub / Resume Verified
02 Certified CompTIA Security+, Microsoft SC-200, AZ-104 and AZ-900.Official badges below. Certificates shown on request. On request
03 Works in security Governance, risk and compliance analyst on a current contract (2026 to now), after two years as a SOC analyst.Full history on the resume Resume
04 Has shipped for clients Client sites you can open right now: 7starcollective.com and budkutz.com.Plus active AI and IT retainers (details under NDA) Live
05 Builds in public Two products of my own, live: TreeTrace and Oversight Protocol, plus published security research.The research ledger Public
06 Clear pricing Websites from $350. AI and IT consulting starts at $2,000 a month and is priced to the scope. Written scope before any work starts.Every tier listed below Published
07 Easy to reach [email protected], or put a call on my calendar. You talk to me, not a sales team.Payments by Stripe invoice Open
08 Client references Ask on our call and I will connect you with a current client who has agreed to talk.Written vouches are being collected; none are invented On request
Last checked Found something out of date? Email me and I will fix it the same day.

02 / What I do

Three things, done properly.

Every job ends with something you can check: a working system, the access in your name, and a written record of what was built.

AI agents and automation

Agents that answer, follow up, sort and report, wired into the tools you already pay for. Each one does one job you can check, and leaves a log of what it did.

From $2,000 / month, scoped to the work
  • Lead intake, follow-up email and booking flows
  • Voice notes and inboxes turned into tasks and summaries
  • Daily reports pushed to your phone
  • CRM, Stripe, calendar and spreadsheet wiring
  • Local or cloud models, with permissions and failure handling

You get: the working agent, its run log, and instructions your team can follow.

Websites and platforms

Fast sites and member platforms where the forms arrive, the booking works and payments land. Designed for the visitor, built to be maintained.

From $350 + $80 / month care
  • Design and build, from copy and structure to launch
  • Booking, Stripe payments and member signup
  • Hosting, backups and updates after launch
  • Speed, search and accessibility basics done right
  • Redesigns of sites that stopped working for you

You get: the live site, editable source, and accounts in your name.

Security and IT

The discipline from two years in a SOC, applied to your business. Find what is exposed, fix the basics, and keep a record you can show a client or an auditor.

Fixed fee, quoted after a call
  • Microsoft 365 and Google Workspace hardening, MFA
  • Website, app and vendor security reviews
  • Backups that are actually tested by restoring them
  • Access reviews and offboarding checklists
  • NIST and CMMC readiness groundwork

You get: findings with evidence, a fix list in priority order, and the fixes if you want them.

03 / Proof of service

Case files.

Real work, live on the internet. Open any of them and look around. Client work that is under NDA stays redacted.

CF-001 / ClientLive / under care

7 Star Collective

Full build and ongoing care for a fitness coaching brand: challenge landing pages, member signup, workout programming and Discord onboarding.

ReactSupabaseStripeMonthly care
7 Star Collective homepage
Open 7starcollective.com ↗
CF-002 / ClientLive

Bud Kutz

Brand and multi-page site for a Memphis barber and loctician: portfolio gallery, booking handoff and a community page.

BrandMulti-page siteBooking
Bud Kutz homepage
Open budkutz.com ↗
CF-003 / ClientActive / NDA

AI and IT systems, agency

AI and IT systems consulting for a Meta-ads agency owner, on a monthly retainer. Name, numbers and screens stay private by agreement.

AI agentsAutomationITRetainer
Reference available on request
CF-004 / My productLive

TreeTrace

A local, redacted record of what an AI coding agent did: files touched, secrets contacted, refusals, and where a human stepped in. Built for audit and GRC teams.

NodeZero dependenciesLocal-first
TreeTrace product site
Open treetrace.dev ↗Read the writeup
CF-005 / My productLive / open source

Oversight Protocol

An open-source protocol for proving where a file came from and that nobody changed it. I am the lead maintainer: a 12-crate Rust workspace with a matching Python implementation and 141 tests.

RustPythonPost-quantum cryptoSigstore
Oversight Protocol site
Open oversightprotocol.dev ↗Read the writeup

Work log

Shipping, continuously.

Dated, sourced, newest first. Client work under NDA appears redacted.

EngagementClient name AI/IT systems consulting retainer for a Meta-ads agency owner
ProductTreeTrace 0.10.5 published to npm, the latest release of the local-first regression-eval tool for AI coding agents.↗
Client7 Star Collective: Ask-AI assistant for the members app built, with tool use and a doubled safety filter.
ClientBud Kutz: barbershop website built, deployed to Cloudflare Pages and put on budkutz.com.↗
ProductTreeTrace v0.10.0 released, three days after the v0.6.0 launch release.↗
ProductOversight Protocol v0.4.12 released: security hardening, JCS canonicalization shared across the Python and Rust implementations, and a post-quantum KEM mirror.↗
ProductTreeTrace v0.6.0 released on npm and GitHub, adding the --graph visual tree.↗
ProductTreeTrace first published to npm (0.2.0), with eight more releases over the next two days.↗
Client7 Star Collective: Summer Reset Challenge (landing page, signup, gated workout grid, checkout) built and put on a Cloudflare Pages preview.↗
ProductOversight Protocol, an open protocol for document provenance and leak attribution, first committed to GitHub; v0.5.0 with Sigstore Rekor v2 logging and a Rust crate followed the same day.↗
ResearchRoot-cause analysis of OpenPGP.js CVE-2025-47934, a signature-verification bypass patched in v6.1.1. An analysis of a public CVE, not a new discovery.↗
Client7 Star Collective: member app build starts in version control, and is still shipping commits in October (315 commits total).↗

Research / Technical proof

The technical record.

Bugs I found and reported to vendors, and the tools I built to find them. Every number here is counted from the pages it links to.

31Disclosed findingsreported to the vendor
6Vendors and targetsFireblocks, Aiven, AXIS, Electroneum, Mattermost, one cloud platform
15High or criticalas rated on each page
19Tools and projectsbuilt and run
18Writeupsdesign and engineering notes
01
★Flywheel
An autonomous vulnerability-research platform: a 7-agent decision graph that maps a target, hypothesizes bugs, drafts exploits, and only reports findings a deterministic validator could reproduce. · VULN RESEARCH · Active
VULN RESEARCH
2025
ACTIVE
02
★CYCLOPS
An autonomous vulnerability-research engine: reproduced findings across 20+ open-source targets using a strict reproduce-before-report discipline. ASan crashes, live SQL rows, and executed command chains are the only valid proof. · VULN RESEARCH · Research
VULN RESEARCH
2026
RESEARCH
03
★GEMINI Malware-Research Lab
A self-contained malware-analysis lab: static-triage pipeline, ransomware detonation in a sealed VM, live memory forensics, and AES key recovery from a 4.13 GB ransomware memory dump. · VULN RESEARCH · Shipped
VULN RESEARCH
2026
SHIPPED
04
Detection-as-Code
Ten ATT&CK-mapped Sigma rules that compile cleanly to Splunk SPL, Elastic ES|QL, and Microsoft Sentinel KQL. Linted and tested in CI, behaviourally validated by Atomic Red Team before promotion. · DETECTION ENG · Shipped
DETECTION ENG
2025
SHIPPED
05
JWT Differential Fuzzer
Feeds identical tokens into 5 JWT libraries at once and flags any disagreement. A verifier split is an auth-bypass primitive. · VULN RESEARCH · Research
VULN RESEARCH
2026
RESEARCH
06
Electroneum QBFT HasBadProposal Quorum Inconsistency Enables Permanent Consensus Stall
One Byzantine validator can stall the whole chain permanently: a quorum check that holds in one code path and not in the other. · Critical (P1) · CWE-670 · Disclosed
Critical (P1) · CWE-670
2026
DISCLOSED
07
Autovacuum Arbitrary Code Execution via Expression Index Shadow Functions
Code execution in the PostgreSQL superuser context on a managed service, reached through the autovacuum worker. · High (P2) · CWE-269 · Disclosed
High (P2) · CWE-269
2026
DISCLOSED
08
Stack Overflow in JSONMergePatch Crashes Aiven Managed ClickHouse via Single SELECT Query
One SELECT, from any authenticated account, crashes a managed ClickHouse instance. Unbounded recursion in JSONMergePatch. · High (P1) · CWE-674 · Disclosed
High (P1) · CWE-674
2026
DISCLOSED
Open the full research ledger Disclosed findings include two critical consensus bugs in a blockchain node and code execution on a managed database service.

04 / Credentials

Certified. Tested in a real SOC.

Industry certifications, two years on a security operations floor and a public research record. The same standards go into every client system.

Experience, newest first

  1. Jul 2026 to present

    Governance, Risk and Compliance Analyst Contract

    Vendor and software security assessments: risk registers, remediation guidance and control mapping, tracked to closure.

  2. Apr 2026 to present

    Independent Security Researcher

    Coordinated vulnerability disclosure through managed bug-bounty programs. Nothing is reported until it reproduces.

  3. Ongoing

    Founder, Zion Click Create

    AI, IT and web consulting for small businesses. Retainer details under NDA.

  4. May 2025 to 2026

    SOC Analyst I Cyber Guards

    Alert triage and incident response across SIEM and EDR tooling for an MSSP's clients.

  5. Jul 2024 to May 2025

    Junior Cyber Security Analyst Cyber Guards

    Alert validation, log review and incident documentation. Promoted to SOC Analyst I.

  6. Jun 2023 to Jun 2024

    Relationship Banker Bank of America

    Daily security and compliance checks and multi-factor identity verification.

  7. 2020 to 2023

    Government (DoD) and contract work NDA

    Multiple government and private contracts, including Department of Defense work. Details under NDA.

Read the full resume →

Eligibility: U.S. citizen, eligible for a security clearance. Experience aligned to NIST SP 800-171, NIST SP 800-53 and CMMC. Tooling: Microsoft Sentinel, Splunk, SentinelOne, Wazuh, Elastic, KQL, SPL, Sigma, MITRE ATT&CK.

In their words

Vouches.

Written by clients, published with their approval, unedited.

“Working with Zion has always been a smooth experience and process. Through building out innovative projects and overviewing the day to day technical aspects of our company, I've been impressed with the quality of his work. I can continue to count on Zion as we work together to scale the company.”

Bryan Payne Jr. / Founder / 7 Star Collective

05 / Pricing

Prices, in public.

No "contact us for a quote" games on the standard work. Bigger jobs get a written scope and a fixed price before anything starts.

Website / Launch

A site that does its job

$350build
+ $80 / month care

A focused site for a small business, launched and looked after.

  • Design, copy structure and build
  • Contact form and booking link that arrive
  • Hosting, updates and backups
Start a site
AI consulting / Retainer

An AI and IT operator, on call

$2,000/ month to start
Final price set by the scope. Month to month.

Agents, automations and IT built and run for your business. Bigger or more complex work is priced to match, in writing, before it starts.

  • New agents and automations each month
  • IT, accounts and security help included
  • Monitoring, fixes and a run log
  • Direct line to me
Book a call
Security + IT / Review

Know what needs fixing

Fixedfee
Quoted after a 30-minute call

A scoped review of your accounts, site, devices or vendors, with the fixes in priority order.

  • Findings with evidence
  • Remediation plan you can act on
  • Optional: I do the fixes
Ask for a review
USD. Invoiced through Stripe. Written scope before work starts.Want to build agents yourself instead? The Operator's Circle is my 8-week mentorship.

06 / How it works

Four steps. No surprises.

You always know what is being built, what it costs and what you will own at the end.

  1. 01

    Call

    Thirty minutes on what is costing you time or money, and whether I am the right person to fix it.

    Day 1
  2. 02

    Written scope

    What gets built, what it costs, what "done" means and what you will own. Nothing starts until you agree.

    Within a few days
  3. 03

    Build and check in

    You see working pieces as they land, not a big reveal at the end. You approve each one.

    Weeks, not months
  4. 04

    Handoff and care

    Accounts in your name, a written record of the system, and ongoing care if you want it.

    Monthly, optional

07 / Questions

Straight answers.

If yours is not here, email it. You will get an answer from me.

Q.01Who will I actually work with?

Me. Zion Click Create is my consulting practice. I scope the work, build it and answer your emails. There is no account manager in between.

Q.02Do you work with businesses outside Arizona?

Yes. Almost all of the work is remote: calls, shared screens and access you grant and can revoke.

Q.03Who owns the site, the code and the accounts?

You do. Domains, hosting, payment and tool accounts are set up in your name wherever possible, and you get the source and a written record of how it fits together.

Q.04Is it safe to give an AI agent access to my business?

Only with limits, which is how I build them. Each agent gets the narrowest access that does the job, its actions are logged, and anything risky waits for a human to approve it. Security is my day job, so this part is not an afterthought.

Q.05How do payments work?

Through Stripe invoices. Builds are invoiced as set out in your written scope, and care plans and retainers are billed monthly. You can see every charge in your Stripe receipt history.

Q.06I want to learn to build agents myself.

That is what The Operator's Circle is for: an 8-week mentorship where you build working agents for your own business with me.

Q.07I'm hiring for a security role.

Start with the resume and the research ledger, then email [email protected].

08 / Contact

Let's talk.

Tell me what is getting in the way. If I can't help, I will tell you who can.

Not ready for a call? Get the free AI agent kit: 11 prompts to start building on your own.

CallPick a time on my calendar Email[email protected] LinkedInin/zion-boggan-92b84b1a1 GitHubgithub.com/zionboggan Instagram@zionboggan
New project requestEncrypted in transit

Do not put passwords or access keys in this form.