Projects
Everything here is documented, not just listed. Where a project has a write-up, the last column links to it; where the code is public, so does the repo. Private employer and client work has no repo link — the write-up is the artifact.
For the three-minute version, the homepage has the highlights.
Platform & DevSecOps work
From my role at Developer Akademie GmbH. The repositories are private; the write-ups and the numbers are not.
| Project | Outcome | Stack | Write-up |
|---|---|---|---|
| Terraform golden paths on GCP | Provisioning 4 h → 45 min | Terraform, Cloud Run, Cloud SQL, IAM | Blog |
| Agentic runbooks with an approval gate | Response time −60% on known failures | Go, MCP, GCP, Terraform state | Blog |
| Ephemeral per-user AWS sandboxes | 80+ envs, compute spend −50% | AWS EC2 (t3/t4g), Terraform, n8n | Blog |
| SLO-gated deploys with automatic rollback | Deploy error rate under 2% | Prometheus, Grafana, GitHub Actions | Blog |
| Security scanning in the delivery path | SAST and DAST blocking, not advisory | Bandit, Semgrep, OWASP ZAP, Trivy | — |
Products
Things I build and run myself.
| Project | What it is | Stack | Links |
|---|---|---|---|
| Emavi (formerly HepaAssist) | Barrier-free multi-tenant PWA for assisted-living facilities: residents log daily mood, staff see trends and generate reports. | Next.js, Django, PostgreSQL, Docker, Web Push | Docs |
| AI Chatbot Platform | Multi-tenant chatbot with appointment booking, embeddable as a widget with Shadow DOM isolation and per-tenant CORS validation. | Next.js, Prisma, OpenAI, Shadow DOM | Docs |
| Standly | AI trade-fair-stand designer: prompt or RFQ in, buildable and quotable 3D booth out. Parametric catalog core, RFQ → BOM → quote. In development. | TypeScript monorepo, 3D, diffusion renders | — |
| CaptureDesk | Linux-first Electron screen recorder on the Loom Record SDK, with a drawing overlay and a local Express backend. | Electron, Node.js, Express | — |
| n8n Workflow Workspace | Versioned workspace for personal and per-client n8n automations. Strict client separation by tag and name prefix; secrets never in git. | n8n | — |
| This site | Docusaurus on GitHub Pages behind a custom domain. Zero third-party requests, self-hosted fonts, offline search. | Docusaurus 3, GitHub Actions | Docs |
Smaller projects
Containers and deployment work. Older and smaller, still documented.
| Project | What it covers | Links |
|---|---|---|
| Conduit pipeline | GitHub Actions: clone → build image → deploy over SSH with Compose | Docs · Repo |
| Conduit container | Compose stack for an Angular frontend and a Django backend | Docs · Repo |
| Truck Signs API | Django + DRF store with Stripe, containerised | Docs · Repo |
| VM setup & hardening | nginx, SSH keys, disabling password auth, managing multiple identities | Docs · Repo |
Security exercises
Deliberate practice against intentionally vulnerable targets, documented as I worked through them. These are exercises, not client engagements — labelling them as anything else would be dishonest, and they are more useful this way: the value is in the reasoning, not the trophy.
| Set | What it covers | Links |
|---|---|---|
| OWASP Juice Shop | Four challenges end to end — API-only XSS, CAPTCHA bypass, admin registration, deluxe fraud — with the request traces | Docs · Repo |
| Python security tooling | Scripted scanning, cracking and metadata extraction — nmap, hydra, hashcat, exiftool-style metadata handling — one page per tool | Docs · Repo |
Everything in that section was run against targets I own or that exist to be attacked. Running these techniques against systems you have no written permission to test is illegal.