I build product code and study how software fails.

University of Maryland — College Park, MD

BACHELOR OF SCIENCE IN COMPUTER SCIENCE · AUGUST 2023 – MAY 2027

Relevant coursework: Computer & Network Security, Computer Systems, Algorithms

Lawly

• Led code review for a six-engineer team, merging 162 of 355 pull requests (46%) and authoring the house rules and development workflow the team ships under.
• Authored 944 commits on a Next.js / React / TypeScript marketplace (Fastify, Drizzle ORM, PostgreSQL, Stripe), shipping 72 additive schema migrations and 526 test files holding 4,269 test cases across payments, messaging, and access control.
• Designed and shipped Stripe idempotency keying across four checkout flows, eliminating duplicate-charge risk on retry while still allowing legitimate repeat purchases.
• Fingerprinted a scraper rotating IPs by its JA4 TLS signature (64% of traffic on a single route), validating the rule in monitor mode before enforcing, and maintained the bot ruleset to block malicious crawlers while preserving legitimate LLM crawler access.

READ THE CASE STUDY

CodePath — Tech Fellow

REMOTE · FEBRUARY 2026 – PRESENT

• Facilitated weekly breakout sessions for cybersecurity and technical interview prep courses, guiding students through hands-on labs, algorithmic problem solving, and debugging.
• Supported student development across data structures, Big O analysis, Linux, networking, and threat detection using Socratic questioning and real-time feedback.
• Ran hands-on labs covering Metasploit, Active Directory, and Azure security as part of the blue team curriculum.

Campus Coders Crew — Developer

COLLEGE PARK, MD · FEBRUARY 2026 – SEPTEMBER 2026

• Built full-stack web apps for UMD student organizations using React, Node.js, and TailwindCSS, designing REST endpoints and coordinating deliverables with a cross-functional team on an Agile / Scrum cycle.

CARLOS EMR — Open Source Security Contributions

JAVA / SPRING / JSP / JQUERY / DOCKER · 3 MERGED

• Patched a stored XSS vulnerability by adding context-sensitive OWASP output encoding across 5 unescaped JSP locations, closing off arbitrary script execution on the document-edit form.
• Stripped PHI-correlating request bodies out of ticklerREST logging, swapping verbatim JSON for safe operational metadata so patient data no longer persists in application logs.
• Fixed a CSRF bypass in the tickler note dialog by switching a jQuery AJAX mutation from GET to POST, restoring CSRFGuard token validation and keeping clinical notes and patient IDs out of URLs and Tomcat access logs; reproduced all three issues in Docker, all three merged upstream.

READ THE CASE STUDYSOURCE

AI-Powered Cyber Threat Reporter

PYTHON / FASTAPI / REACT / POSTGRESQL / GEMINI / DOCKER · LIVE

• Built a full-stack threat-intelligence tool that takes text, URLs, and file uploads and returns AI-generated severity ratings with structured remediation steps, powered by Gemini.
• Secured the REST API with Supabase JWT auth, per-user rate limiting, and async PostgreSQL (asyncpg); wrote a batch log parser splitting files into parallel Gemini calls with rate-limit-aware throttling, deployed on Render via Docker with a React frontend on Vercel.

LIVE SITESOURCE