Deployments
Things I actually built and shipped. Each runs on its own subdomain, and each is privacy-first by design.
$ dig +short *.0x6a03448f4d.com
headers
Security header & posture scanner
A security-header and posture scanner that grades any site's HTTP defenses - a deep Content-Security-Policy evaluator, plus TLS, cookie, CORS, DNS/email (SPF/DKIM/DMARC/MTA-STS) and WHOIS checks, with copy-paste fixes for every finding. Every scan runs server-side behind strict SSRF protection - scheme/port allow-listing and IP-pinning that closes DNS-rebinding - is rate-limited, refuses internal, government and special-use targets, and stores nothing. Ships an embeddable, server-signed grade badge.
Security+ SY0-701 Study Portal
Local-first exam prep engine
A full CompTIA Security+ (SY0-701) training platform I built from scratch. Weighted exam-readiness scoring by official domain percentages, adaptive custom quizzes, performance-based question (PBQ) labs, exam simulations, spaced-repetition flashcards, and a gamified XP / achievement system to keep the grind honest.
vault
Client-side security toolkit
A privacy-preserving password toolkit that runs entirely in the browser. Local strength analysis, CSPRNG passphrase and password generation, a Have I Been Pwned breach check via k-anonymity, plus base64/hex/JWT tooling - the password never leaves the device. No backend, no tracking, nonce-based CSP.
paste
Zero-knowledge pastebin
An encrypted pastebin where the server never sees the plaintext. Text is encrypted in the browser with AES-256-GCM; only ciphertext is stored and the key travels in the link fragment. Burn-after-read, auto-expiry, a creator deletion token, rate limiting, and a nonce-based CSP.
OWASP Top 10 Labs
Ten OWASP Top 10 projects, one curriculum
A hands-on platform covering all ten OWASP Top 10 projects - Web, API, Mobile, LLM & GenAI, Kubernetes, CI/CD, ML Security, Smart Contract, Serverless, and the Proactive Controls - across sixteen editions from 2016 to 2025. Every entry has a full lesson and a one-page cheat sheet. The reading half is a static site; the vulnerable labs are deliberately never hosted, running instead in throwaway Docker containers on your own machine or a Codespace, so nothing exploitable is ever public.
PrivEsc Matrix
GTFOBins + LOLBAS + WADComs, unified
An offline-first privilege-escalation workbench that unifies six sources (GTFOBins, LOLBAS, WADComs, GTFOArgs, HijackLibs, LOLDrivers) into one instant search, with a reverse-shell generator, MSFVenom builder, TTY-upgrade and pivoting cheatsheets, and an enumeration scanner: paste your find -perm -4000 or sudo -l output and it highlights which binaries are exploitable.