Ships software fast.
Breaks it professionally.

Independent. Application security testing and full-stack build work. A year of engagements for banks, payment processors and consumer platforms; on my own since.

Web application assessment, reconnaissance, remediation write-ups, and incident response on compromised sites.

React and Next, Python, Node, Docker, CI, deployment. Front to back, including the parts nobody volunteers for.

Most of the work sits here: shipping quickly, then auditing what got shipped. AI-assisted development made the first half cheap and the second half necessary.

sounding PYTHON · MCP · STATIC ANALYSIS

A linter for the configuration that drives AI agents. Tool descriptions and skill files are injected into a model's context on every request — they decide which tool gets called, with what arguments, and whether the client asks before something is destroyed. They are production config, and almost nobody reviews them. 

$ sounding audit .mcp.json

  HIGH   MCP006  tool:delete_file
         Marked readOnlyHint=true but the description describes
         a mutation. The annotation contradicts the tool.
         ref  MCP spec — Tool annotations
         fix  Set readOnlyHint=false, add destructiveHint.

  score  0/100   100 - [7xhigh(15) + 6xmedium(7)] = 0

Deterministic rules, no model in the loop. Validating it meant running it against 35 skills written by other people — it reported a 46% false-positive rate in my own rules, including one that flagged security guidance because it quoted an attack string. All four defects are regression tests now.

More as it ships.

Seven design languages, seven techniques, no libraries. Scroll and you fall through them. At most two stages ever render — the rest are stopped dead, because seven simultaneous animations is the exact incompetence a section like this usually proves.

−0000m
00 / VOID
Nothing but type

No colour, no shape, no chrome. Characters rising past you as you fall. When a layout works with nothing but a typeface and space, everything after it is a choice rather than a rescue.

CANVAS 2D · ONE TYPEFACE
01 / LIQUID GLASS
Everything soft, everything colour

Blobs fused by an SVG filter — blur, then a steep alpha contrast ramp, so shapes that touch become one surface. This panel is real backdrop-filter, blurring the live pixels behind it, not a translucent rectangle pretending.

SVG FILTER · BACKDROP-FILTER
CERAMIC
Stoneware mug €28.00
LINEN
Washed apron €45.00
PAPER
Bound notebook €19.00
02 / COMMERCE
Light, warm, and built to sell

The only bright stage here, and the language a client is most likely to actually need. Restrained type, generous whitespace, one clear action per card, and a lift on hover that costs nothing because it is a transform. A descent through seven dark rooms is one room.

LIGHT MODE · PRODUCT UI
03 / PHYSICAL
Weight and material

Verlet integration with distance constraints, relaxed four times a frame. Drag across it to tear it. The entire solver is fifteen lines — physics is usually less code than the library you were about to install for it.

VERLET PHYSICS · NO LIBRARY
04 / VECTOR
Blueprint

An icosahedron rotated on two axes, projected with the perspective divide written out in full, faces sorted back to front by the painter's algorithm. No three.js — the point is the maths, not the import.

3D BY HAND · PAINTER’S ALGORITHM
05 / SIGNAL
Signed distance fields

A raymarched surface: 72 steps per pixel in a fragment shader, normals taken from the gradient, Fresnel on the rim. The CPU sends two numbers per frame and does nothing else — everything visible is computed on the GPU, per pixel, every frame.

WEBGL · GLSL · RAYMARCHING
06 / PIXEL
And this is the one I chose

Four colours, an integer grid, and nothing permitted outside them. The portrait resolves the way a sonar return arrives — top to bottom, a brighter edge leading it. It is the first thing this site ever drew. Every language above is buildable. Deciding which one the work deserves is the actual job.

CANVAS 2D · 44×44 · 4 COLOURS

A year of application security work at a two-person consultancy, running engagements end to end — scoping, testing, reporting, client meetings — for organisations in banking, payments, logistics and consumer goods. Alongside that, three production systems built and deployed from scratch.

Client names stay with the clients.

github.com/alinotfound Source for everything above security.txt Vulnerability disclosure