Projects
Everything here is documented, not just listed. Where a project has a write-up, the last column links to it; where the code is public, so does the repo. Private employer and client work has no repo link; the write-up is the artifact.
For the three-minute version, the homepage has the highlights.
Platform & DevSecOps work
From my role at Developer Akademie GmbH. The repositories are private; the write-ups and the numbers are not.
| Project | Outcome | Stack | Write-up |
|---|---|---|---|
| Terraform golden paths on GCP | Provisioning 4 h → 45 min | Terraform, Cloud Run, Cloud SQL, IAM | Blog |
| Agentic runbooks with an approval gate | Response time −60% on known failures | Go, MCP, GCP, Terraform state | Blog |
| Ephemeral per-user AWS sandboxes | 80+ envs, compute spend −50% | AWS EC2 (t3/t4g), Terraform, n8n | Blog |
| SLO-gated deploys with automatic rollback | Deploy error rate under 2% | Prometheus, Grafana, GitHub Actions | Blog |
| Security scanning in the delivery path | SAST and DAST blocking, not advisory | Bandit, Semgrep, OWASP ZAP, Trivy | none |
Products
Things I build and run myself.
| Project | What it is | Stack | Links |
|---|---|---|---|
| Agent Delivery Pipeline | Gated delivery for agent-generated n8n workflows: builder and reviewer agents whose rights are enforced by hooks, a forced failure before the real run, and an acceptance log that is actually counted. | Claude Code agents, n8n, Python, Docker | Docs · Blog |
| Falar | Speaking tutor for European Portuguese on OpenAI's Realtime API, in internal test on Google Play. The phone talks to the model directly; the backend owns the session, guards every call over a sideband connection and measures minutes by its own clock. | Expo, Django, OpenAI Realtime, GCP OAuth, Docker | Docs · Blog |
| Runnz | Multi-tenant SaaS for trade-fair construction scheduling. Reusable workflow blocks derive every deadline from the build date; secret scanning and dependency audit block in pre-commit and CI. | NestJS, PostgreSQL, React, Docker | Docs · Live |
| Emavi (formerly HepaAssist) | Barrier-free multi-tenant PWA for assisted-living facilities: residents log daily mood, staff see trends and generate reports. | Next.js, FastAPI, PostgreSQL, Docker, Web Push | Docs |
| AI Chatbot Platform | Multi-tenant chatbot with appointment booking, embeddable as a widget with Shadow DOM isolation and per-tenant CORS validation. | Next.js, Prisma, OpenAI, Shadow DOM | Docs |
| CaptureDesk | Loom recorder for Linux on the Loom Record SDK. Runs third-party code next to the screen and camera, so permissions are decided by origin and the local server rejects foreign Host headers against DNS rebinding. | Electron, Node.js, Express | Docs · Blog · Repo |
| This site | Docusaurus on GitHub Pages behind a custom domain. Zero third-party requests, self-hosted fonts, offline search. | Docusaurus 3, GitHub Actions | Docs |
Smaller projects
Containers and deployment work. Older and smaller, still documented.
| Project | What it covers | Links |
|---|---|---|
| Conduit pipeline | GitHub Actions: clone → build image → deploy over SSH with Compose | Docs · Repo |
| Conduit container | Compose stack for an Angular frontend and a Django backend | Docs · Repo |
| Truck Signs API | Django + DRF store with Stripe, containerised | Docs · Repo |
| VM setup & hardening | nginx, SSH keys, disabling password auth, managing multiple identities | Docs · Repo |
Security exercises
Deliberate practice against intentionally vulnerable targets, documented as I worked through them. These are exercises, not client engagements. Labelling them as anything else would be dishonest, and they are more useful this way: the value is in the reasoning, not the trophy.
| Set | What it covers | Links |
|---|---|---|
| OWASP Juice Shop | Four challenges end to end (API-only XSS, CAPTCHA bypass, admin registration, deluxe fraud) with the request traces | Docs · Repo |
| Python security tooling | Scripted scanning, cracking and metadata extraction (nmap, hydra, hashcat, exiftool-style metadata handling), one page per tool | Docs · Repo |
Everything in that section was run against targets I own or that exist to be attacked. Running these techniques against systems you have no written permission to test is illegal.