The evidence ledger.

Vulnerability research is slow, manual work, and AI tools tend to invent “findings” that don't actually reproduce, wasting triage time and eroding trust.

I designed and built the whole system: a staged decision graph that maps a target, forms a hypothesis, drafts a proof-of-concept, and only reports a finding once a deterministic validator reproduces it end-to-end.

Reproduced proof-backed findings across 20+ open-source projects under a strict reproduce-before-report standard. Built strictly for authorized testing.

Responding to ransomware means recovering evidence from an infected machine without letting the malware spread or losing what happened.

I stood up the isolated environment, detonated real ransomware, captured a 4.1 GB live memory image, and wrote a scanner that recovered the encryption keys from memory, then rebuilt the attack timeline.

Recovered AES key schedules from memory and reconstructed the full encryption timeline. Every claim is backed by captured evidence.

Detection rules drift, go untested, and get rewritten by hand for every SIEM, so gaps and false positives pile up.

I wrote Sigma detections mapped to MITRE ATT&CK, added automated linting and tests in CI, and compiled them from one source to Splunk, Microsoft Sentinel, and Elastic.

Validated, version-controlled detections that stay consistent across three SIEM platforms with audit-ready test evidence.

As AI-generated and forged content grows, organizations need a tamper-evident way to verify the origin and integrity of files.

I'm the lead maintainer. I built a Rust core and a matching Python reference implementation with bit-identical results, using modern and post-quantum cryptography plus a public transparency log.

12-crate Rust workspace with a conforming Python implementation and 141 tests. Live and public.