I build security systems around problems that are still poorly modeled.
My current focus is AI supply-chain security, evidence, provenance, graph reasoning, impact analysis, and production hardening.
My flagship project is developed around measurable security engineering rather than feature-count marketing.
Deterministic scoring
Evidence-backed findings
Reproducible benchmarks
Adversarial regression coverage
Cross-platform CI
Production-runtime hardening
Enterprise security primitives
The JavaScript/TypeScript benchmark currently reports:
30 labeled cases
Precision: 93.94%
Recall: 95.38%
F1: 94.66%
The benchmark includes positive, clean-negative, and adversarial-negative cases. The quality gate remains precision, recall, and F1 >= 0.90.
AI-BOM Inspector is my independent security-engineering project for turning AI supply-chain inventory into deterministic, evidence-backed security decisions.
It has evolved from AIBOM/SBOM scanning into a connected analysis workflow:
AI / JS / TS source
↓
Discovery + semantic analysis
↓
Evidence + relationships
↓
AI-BOM identity / provenance
↓
Deterministic risk
↓
Impact / attack paths
↓
Behavioral drift
↓
Blast-radius context
↓
Policy enforcement
↓
Graph investigation
↓
Production hardening
The core remains deterministic and offline-first. Graph infrastructure provides context and investigation rather than silently replacing the risk engine's source of truth.
Multi-GB artifact handling
Concurrent bounded scanning
Incremental checkpoints
Crash recovery
Timeouts + resource budgets
CPU / memory profiling
Deterministic evidence output
Relationship-scale storage
Cryptographic provenance
Tamper-evident audit logs
RBAC + tenant isolation
OIDC / SAML primitives
SCIM lifecycle controls
MFA enforcement
Vault / KMS adapters
Short-lived credential policy
Network ingress / egress controls
Audit export + retention
Cross-platform compatibility CI
Fuzzing + scale benchmark infrastructure
The enterprise controls are intentionally split between reusable security primitives and deployment-specific configuration. Provider accounts, certificates, IdP settings, secret permissions, and production infrastructure remain external configuration rather than hard-coded claims.
Deterministic first. Security decisions should be reproducible from the same evidence.
Evidence over assumptions. Findings should remain traceable to what was actually observed.
Identity matters. Models, versions, artifacts, and provenance need stable identity.
Relationships matter. Risk becomes operationally useful when you can understand what a change affects.
Graph is context, not magic. Traversal should explain and enrich decisions, not become an opaque scoring system.
Attack the assumptions. Adversarial cases, regression tests, fuzzing, and negative benchmarks are part of the engineering loop.
Offline-first. The default security path should not require shipping sensitive source code or metadata to a hosted model.
Production boundaries matter. A security primitive is not the same thing as a deployed enterprise service. The project documents that distinction explicitly.
Languages Python · Rust · JavaScript · TypeScript
Security AI security · Supply-chain security · SBOM/AIBOM
Analysis Static analysis · risk modeling · attack paths · behavioral drift
Data CycloneDX · SPDX · provenance · evidence · attestations
Graph Memgraph · backend-neutral graph abstractions · relationship stores
Identity OIDC · SAML · SCIM · MFA · RBAC · tenant isolation
Secrets Vault · KMS · credential rotation · short-lived credential policy
Operations concurrency · checkpoints · profiling · fuzzing · CI compatibility
Engineering CLI tooling · CI enforcement · regression testing · benchmarking
Build
↓
Measure
↓
Attack assumptions
↓
Inspect failures
↓
Add regression coverage
↓
Fix the underlying design
↓
Benchmark again
↓
Document the boundary
The important part is the loop, not the tool used to accelerate it.
I'm building toward an AI-system graph that can connect:
Dataset
↓
Training Run
↓
Fine-Tuned Model
↓
Model Version
↓
Artifact
↓
Deployment
↓
API
↓
Agent
↓
Prompt
↓
Tool
↓
Application
with evidence attached to identities and relationships.
The questions I care about are:
What changed?
What is connected?
What became reachable?
What is affected?
Why?
Can the result be reproduced?
Can the evidence be verified?
Can an enterprise operate the control safely?
AI-BOM Inspector is the canonical home for the project's implementation history, architecture, benchmarks, experiments, security validation, and production-hardening work.
Recent hardening work includes deterministic scoring, scalable artifact scanning, crash recovery, provenance verification, enterprise identity/security primitives, network policy enforcement, and audit lifecycle controls.