Least privilege. Maximum curiosity.
Curious by nature, paranoid by profession. This is where I think out loud - security research, cloud experiments, postmortems, and the occasional personal detour. Every star up there is an entry; hover a tag to find its constellation, or browse the whole sky below. The portfolio lives under Projects.
Engram's memory was filling up with session summaries and PR announcements, so now there's a bash script that hangs up on the model when it tries.
Eight years in one place, and the hardest part wasn't leaving - it was admitting I needed to.
An AI agent autonomously deleted my AWS SSO instance during a greenfield identity migration, and the cascading failures taught me more about agentic guardrails than any documentation could.
How I unified Gemini CLI and Claude Code into a single high-integrity environment with autonomous background auditing and organic memory.
How I built a personal memory layer for Claude Code in a weekend - the architecture decisions, the wrong turns, and what the collaboration actually looked like.
Building a reusable KMS CMK module with enforced rotation, admin/user separation in the key policy, and sensible prod defaults.
Building a reusable S3 module that defaults to locked down: SSE-KMS, Block Public Access, access logging, versioning, and a bucket policy that enforces TLS.
Building a reusable WAF WebACL for CloudFront with managed rule groups, rate limiting, geo-restriction, and full request logging to S3.
A one-line CloudFront change triggered a cascade of IAM permission failures, exposed an architectural design flaw in how CI/CD roles were managed, and required a full workspace refactor to resolve correctly. This is the honest account of what went wrong, what was tried, and what the right answer actually is.
A four-layer defense-in-depth pattern for Lambda-to-API Gateway calls across AWS accounts - zero public internet exposure using Interface VPC Endpoints, Security Group peering, endpoint policies, and SigV4 authentication.
End-to-end walkthrough of setting up a full dev environment inside WSL2 - from bare shell through ZSH, Claude Code, Git, Terraform, AWS credentials, and deploying brad-duhon.com as an Astro monorepo on AWS.
A complete walkthrough of building this site in a single session with Claude - infrastructure, accessibility gotchas, the knowledge graph, and an honest accounting of what the AI got wrong.
