I work on AI agent security, retrieval, and backend hardening, with a focus on fixes that are reproducible, tested, and backed by clear writeups. Most of my recent work is around trust boundaries in agent systems, including shell execution, memory, file handling, network access, and auth.
- AI agent and developer-platform security: host-shell escape, stored XSS, SSRF, prompt poisoning, command injection, path traversal, and unauthenticated API exposure.
- Retrieval and context systems: search plumbing, tags-based cross-subtree retrieval, safer memory and resource access paths, and agent-facing RAG improvements.
- Backend hardening: auth boundaries, file handling, archive validation, network safeguards, and safer runtime defaults.
- Delivery around fixes: focused tests, lint and CI cleanup, reproducible writeups, and remediation PRs.
I spend most of my time in Python, JavaScript, and TypeScript codebases, usually around FastAPI-style backends, agent runtimes, retrieval systems, sandboxes, and CI pipelines.
| Project | What I worked on | Link |
|---|---|---|
| deer-flow | Critical host-shell escape remediation in LocalSandboxProvider |
#1547 |
| OpenViking | Enforced authentication on bot proxy chat endpoints | #996 |
| deer-flow | Stored XSS mitigation for artifact rendering and download handling | #1389 |
| OpenViking | Rejected unsafe ZIP member paths during .ovpack import |
#344 |
| deer-flow | Security review and safe download enforcement work in the fork-to-upstream fix path | #2 |
