Independent systems security engineering

Trust boundaries that survive contact with production.

I work across kernel telemetry, workload identity, protocol state machines, and open-source control planes. The goal is simple: make every security-relevant transition explicit, bounded, and testable.

Inspect upstream patches Open research map

01 Reproduce before patching
02 Preserve protocol invariants
03 Verify the failure boundary

Trace the evidence

SYSTEM TRACE

STATIC / HTTPS

8verified upstream merges highlighted

4core trust-boundary domains

VMisolated verification environment

DCOtraceable contribution history

01 / RESEARCH AREAS

Security properties as system contracts.

Each track starts from a concrete trust boundary and ends with an observable verification condition.

R-01

Runtime security

Confinement, capability reduction, descriptor ownership, and deterministic cleanup across process and hypervisor boundaries.

Kata Containers
Capsicum
Linux namespaces

R-02

eBPF telemetry

cgroup-scoped execution evidence, datapath state machines, conntrack contracts, and evidence-loss handling.

Cilium
Falco
Kernel observability

R-03

Hypervisor confinement

Guest-host interfaces, workload byte preservation, lifecycle ordering, and bounded execution surfaces.

MicroVM runtimes
Guest policy
Resource isolation

R-04

Cryptographic protocols

RFC 5280 path constraints, SPIFFE identity, PKINIT and Kerberos boundaries, authenticated transport metadata.

SPIRE
X.509
AD/Kerberos

02 / UPSTREAM PATCH INDEX

Small patches. Explicit invariants.

Verified merges and current reviews across runtime, identity, protocol, and platform boundaries.

14 patches shown

MergedCILIUM / 49130

GRPCRoute backend TLS policy

Extended Gateway API backend transport validation so GRPC routing follows the same authenticated upstream contract.

GoGateway APITLS

View merged patch

MergedFALCO / 3112

Plugin extraction error propagation

Kept field-extraction failures visible across the libsinsp plugin boundary instead of collapsing the diagnostic state.

C++libsinspTelemetry

View merged patch

MergedSPIRE / 7303

Upstream CA expiry contract

Bound CA rotation and issued SVID lifetimes to the verified upstream X.509 chain expiry.

GoSPIFFERFC 5280

View merged patch

MergedIMPACKET / 2304

Bounded DNS compression traversal

Stopped compressed-name pointer cycles with explicit traversal bounds while preserving valid nested labels.

PythonDNSAD tooling

View merged patch

MergedDEFECTDOJO / 15961

Product-member finding visibility

Aligned finding-group list visibility with product authorization, including groups without findings.

PythonDjangoAuthorization

View merged patch

MergedDEPENDENCY-TRACK / 7323

Authenticated webhook bytes

Added optional HMAC-SHA256 authentication over the exact bytes transmitted to webhook consumers.

JavaHMACWebhooks

View merged patch

MergedAETHER / 3423

Certificate path and issuer validity

Enforced path-length and issuer-validity constraints in certificate-chain verification.

CX.509Path validation

View merged patch

In reviewKATA / 13933

Environment byte preservation

Returns the exact validated key and value slices so guest policy does not mutate approved bytes.

RustGuest policyByte semantics

Inspect review

In reviewCORAZA / 1770

Non-file request-body accounting

Tracks multipart form bytes separately from streamed files across reject and partial-processing paths.

GoSecLangWAF

Inspect review

In reviewSCAPY / 5191

UDP checksum payload coverage

Includes encapsulated payload padding in checksum length and pseudo-header accounting.

PythonUDPChecksums

Inspect review

In reviewLIBCOAP / 2208

Block1 coverage across SZX changes

Preserves acknowledged byte coverage when block-size negotiation changes the transfer geometry.

CCoAPState machine

Inspect review

In reviewNMAP / 3584

SHA-384 TLS signature schemes

Adds SHA-384 schemes to the default NSE TLS offer while preserving version and key-type constraints.

LuaTLSNSE

Inspect review

In reviewRT-THREAD / 11935

Bounded signalfd close lifecycle

Validates descriptor bounds and detaches listener state safely before releasing the descriptor slot.

CRTOSDescriptor lifecycle

Inspect review

In reviewAETHER / 3441

Independent sandbox-policy intersection

Requires in-process grant levels and preload grants to allow the same operation when both are active.

CSandboxingPolicy composition

Inspect review

03 / LAB NOTEBOOK

Reproducible environments, bounded claims.

Project-owned fixtures and isolated systems turn architecture assumptions into evidence.

L-01 Identity Protocol Invariants37 source-linked OAuth/OIDC/MS-PAC/dMSA invariants, bounded parsers, sealed Server 2025 lab evidence Python / PowerShell L-02 Runtime Provenance Firewallcgroup evidence + artifact digests + SLSA/in-toto statements Go / eBPF L-03 Enterprise Purple RangeWindows identity, endpoint, and network evidence correlation Python / Windows L-04 Adversary Validation Rangecontrolled validation actions with benign baselines and detection assertions Python / Sigma L-05 CPS Process-Integrity Harnessdeterministic synthetic process experiments without physical-controller interaction Python / OT

04 / ENGINEERING IDENTITY

Independent, evidence-led, upstream-first.

I am an independent systems security engineer based in Turkey. My work favors narrow patches, explicit ownership rules, and regression tests that preserve the boundary where the original failure occurred.

Research statements are scoped to project-owned fixtures, disposable lab systems, or upstream test suites. Platform limitations are recorded instead of being silently generalized.

05 / CONTACT

Bring a concrete boundary.

For project-specific engineering correspondence, start from the relevant issue or patch. For general contact, use the canonical GitHub account.

Open GitHub profile