Least privilege. Maximum curiosity.
Curious by nature, paranoid by profession. This is where I think out loud - security research, cloud experiments, postmortems, and the occasional personal detour. Every star up there is an entry; hover a tag to find its constellation, or browse the whole sky below. The portfolio lives under Projects.
I stopped stamping out dev, test, stage and prod copies of my control-plane services. One long night of migrations later, environments became rows in a table and the platform still works.
I added a Deny on kms:* to a permissions boundary as defense-in-depth. Every Lambda behind it stopped producing logs, metrics showed errors, and the cause was a decrypt call I never wrote and forgot to infer.
A resource policy that showed but did not enforce, a status code that could not be changed, and a 403 dressed as a homepage. Three REST API behaviors, three lost debugging sessions.
I just wanted to be able to team up with an old coworker again for fun times and work towards something great.
A potential trademark conflict forced me to rename everything, my domain, org, and brand across five AWS accounts, the GitHub organization, Google Workspaces, and Okta Identity. Thankfully, I have a paranoid streak, and it pushed a design weeks earlier, allowing us to cut over in 24 hours.
My wife's supplement tracker has no admin panel. She opens a terminal and talks to Claude, and somehow that's the part of the app that works best.
Spec in, constraints in, two thousand lines of Terraform and Python out in forty minutes. The review found one real defect, and the live apply found two more that no review could have.
An MFA policy failure sat as an accepted plan limitation for two months, and the actual root cause was one missing boolean the provider needed to speak the right API dialect.
Bringing Google Workspace under Terraform with zero stored keys hit three live faults in one day, and every one of them failed closed with an error that pointed at itself.
978 tests, months of maintenance behind them, a standing mention in every PR description, and not one execution in CI across the life of the repo. Adding the gate exposed 94 latent failures nobody had ever seen.
I scheduled a KMS key deletion with a 30-day window and broke every CI init in the org within seconds, because scheduling IS disabling and four state files were still encrypted under it.
Engram's memory was filling up with session summaries and PR announcements, so now there's a bash script that hangs up on the model when it tries.
Eight years in one place, and the hardest part wasn't leaving - it was admitting I needed to.
An AI agent autonomously deleted my AWS SSO instance during a greenfield identity migration, and the cascading failures taught me more about agentic guardrails than any documentation could.
How I unified Gemini CLI and Claude Code into a single high-integrity environment with autonomous background auditing and organic memory.
How I built a personal memory layer for Claude Code in a weekend - the architecture decisions, the wrong turns, and what the collaboration actually looked like.
Building a reusable KMS CMK module with enforced rotation, admin/user separation in the key policy, and sensible prod defaults.
Building a reusable S3 module that defaults to locked down: SSE-KMS, Block Public Access, access logging, versioning, and a bucket policy that enforces TLS.
Building a reusable WAF WebACL for CloudFront with managed rule groups, rate limiting, geo-restriction, and full request logging to S3.
A one-line CloudFront change triggered a cascade of IAM permission failures, exposed an architectural design flaw in how CI/CD roles were managed, and required a full workspace refactor to resolve correctly. This is the honest account of what went wrong, what was tried, and what the right answer actually is.
A four-layer defense-in-depth pattern for Lambda-to-API Gateway calls across AWS accounts - zero public internet exposure using Interface VPC Endpoints, Security Group peering, endpoint policies, and SigV4 authentication.
End-to-end walkthrough of setting up a full dev environment inside WSL2 - from a bare shell through ZSH, Claude Code, Git and GitHub CLI, and the Terraform and Node.js toolchain.
A complete walkthrough of building this site in a single session with Claude - infrastructure, accessibility gotchas, the knowledge graph, and an honest accounting of what the AI got wrong.
