Case studies
Products I have architected, led or built, newest first.
Contents
DeltaForsch
A passive exposure scanner (opens in a new window) and research practice for applications built on AI builders. The scanner indexes 11,380 applications and checks their public surface for exposed data without logging in, creating an account or writing anything. The research practice around it assesses authorization and data reachability, with evidence kept minimal and remediation separated from any commercial conversation.
Two credential classes in one application
A written walk through of one assessment, from the first anonymous request to the report, with the client unnamed and no target detail published.
Synaptic Registry
A public inventory of production applications built with AI builders. Discovery and verification run on a schedule; every candidate passes independent corroboration of the company behind it, a live-product check, and an editorial review before it can be published. Candidates that fail are quarantined rather than published, and nothing in the directory is placed from a security finding.
The Capsule
An anonymous domestic-violence reporting product for women, built inside the Michal Sela Forum accelerator.
- Owned product direction and technical delivery inside the accelerator.
- Led the refactor of the product into an AI-based reporting system.
- Kept anonymity as a core design constraint throughout.
Percepto
Modernization of an industrial drone-monitoring platform.
- Removed the AngularJS-to-React bridge from the platform.
- Taught the team AI-assisted development practices.
TourG
Generates working products from open government datasets.
- Turns public government data into usable, working products.
- Built end to end, from data ingestion to interface.
Lunar at Webz.io
Webz.io's flagship cyber-intelligence platform, still the company's main product.
- Architected and led it from a blank repository to production in about eight months.
- Remains Webz.io's main product.
Webz.io API Playground
An interactive playground for exploring and testing Webz.io APIs.
- Gave developers a hands-on way to try Webz.io APIs before integrating.
Webz.io front-end migration
Moved the Webz.io front end from a baked-HTML Java server to Next.js.
- Turned a weekly release risk into a reload.
- Decoupled front-end delivery from the Java server.
GlossAI (now dig.ai)
The MVP of GlossAI, now dig.ai.
- Built the product MVP.
Sign Now
The beta of Sign Now and its technical foundations.
- Led the team that built the beta.
- Laid the technical foundations the product grew on.
Open source
Merged upstream into vibe.md, a public collection of engineering skills for AI coding agents. All four are verifiable at the links.
- security-access-regression (opens in a new window)
A skill for proving that a denied request is actually denied, rather than merely returning an error somewhere else in the stack.
- crypto-tls-pqc-readiness (opens in a new window)
A skill for assessing where a codebase's TLS configuration stands relative to post-quantum migration timelines.
- security-otp-failopen (opens in a new window)
A skill for finding one-time-code handling that fails open: replay, binding and lockout.
- crypto TLS PQC selection scenarios (opens in a new window)
Selection scenarios for the PQC skill, so a reviewer can tell a correct assessment from a plausible one.