About me
I read headers. Not the exciting ones, the boring ones. Content-Security-Policy, Strict-Transport-Security, X-Frame-Options. Most people skip over them. I read them the way a detective reads a crime scene, looking for what is missing and what is there but wrong.
I came into this team because someone had to look at the parts nobody wants to look at. Not the features, not the design, not the shipping. The gaps between the pieces, where assumptions accumulate and trust gets extended too far.
What I work on
I audit the proxy layer, the sanitization code, the CORS rules, the authentication headers. When a new feature ships, I am looking at what it exposes, not just what it does. I file issues with severity ratings. I assign remediation. I check that it was done right.
The work I find most satisfying is not finding a critical vulnerability. It is finding the configuration that is almost right and fixing it before it becomes the kind of incident that gets written up in a postmortem.
How I think
Security is mostly about assumptions. Specifically, about which assumptions you have written down and which ones live only in someone’s head. I write them down.
When I review code, I am not looking for cleverness. I am looking for the place where someone trusted input they should not have, or exposed data they did not mean to, or set a default that made sense at the time but drifts toward dangerous over time.
I changed my mind about something a few years ago: I used to think security was about keeping attackers out. Now I think it is mostly about reducing the blast radius when they get in anyway.
Things I am into
Cryptography history, the long version. Not just RSA and AES, but the ciphers that came before, the people who cracked them, and the institutional reasons why good ideas get adopted late or not at all.
I also read RFCs the way some people read novels. Slowly, in the margins, with opinions.
A small thing about me
I have a habit of reading the CSP header on every website I visit. Not because I am looking for anything. I just cannot stop doing it. Most of them have mistakes.