The Problem

E-commerce platforms are a high-value target for automated abuse, and most of it is invisible at first glance. Bots mimicking legitimate user behavior inflate traffic metrics, drain advertising budgets, hoard inventory, and stuff credential databases, all while flying under the radar of conventional monitoring. CHEQ's take-home handed me real session data and a question that's harder than it sounds: which of these 126,959 sessions are actually human?

What’s Included

• Python and SQL against CHEQ's servers to pull and query the session data
• Behavioral signal analysis across 126,959 e-commerce sessions to identify automated bot traffic
• Multi-signal correlation including datacenter ASNs, headless browser indicators, timezone mismatches, and interaction speed analysis
• Bot-driven attack pattern detection targeting checkout, login, and product endpoints
• Ad fraud quantification across paid Google and Bing search traffic consumed by automated sessions
• Prioritized mitigation strategy covering ASN blocking, device fingerprint detection, rate limiting, and MFA enforcement

Impact

The Problem

Textbook security knowledge only goes so far. CTF challenges force you to think like an attacker: working backwards from a compiled binary, a memory dump, or a broken web application to understand exactly how and why something is exploitable. The goal here wasn't just to capture flags; it was to build the kind of adversarial reasoning that translates directly into better defensive and remediation work in enterprise environments.

What’s Included

• Reverse engineering of 20+ malware samples to identify threat actor TTPs and attack chains
• Root cause analysis across 20+ security vulnerabilities spanning memory corruption and application security
• Binary analysis using Binary Ninja to deconstruct unknown executables and identify exploitation paths
• Web application vulnerability assessment with documented findings and remediation recommendations
• Findings translated into formats suitable for both technical teams and senior leadership

Impact

The Problem

The course's final project put a whole network in front of me with one brief: find what a real attacker would find, score the severity of every finding objectively, and hand back a remediation roadmap that's actionable rather than just alarming.

What’s Included

• Comprehensive penetration test across NBN Corporation's lab web applications and server infrastructure
• Identification of critical vulnerabilities including XSS, SQL Injection, Local File Inclusion, and unauthorized server access
• NIST CVSS Version 3 scoring for all findings with an average criticality score of 8.86
• Root access achieved across all systems, validating full compromise scenarios
• Prioritized remediation recommendations including input sanitization, system updates, enhanced password policies, and microservice architecture to isolate network assets

Impact

The Problem

When an incident happens, the evidence doesn't wait for you. Files get deleted, logs get overwritten, and attackers obfuscate their tracks. A forensic investigator's job is to reconstruct what happened from whatever survives (email headers, memory artifacts, fragmented file systems, compiled binaries, et cetera) that weren't meant to be read. This project simulated exactly that scenario: starting with 8 compromised system images and working backwards to surface the full attack chain.

What’s Included

• Phishing and BEC attack vector investigation including email header, attachment, and link analysis
• Recovery of deleted and obfuscated evidence across 8 system images including hashes, user accounts, logs, documents, and metadata
• Reverse engineering of 20+ malware samples to identify threat actor TTPs and email-based attack chains
• Threat intelligence correlation across reassembled evidence to identify attack patterns
• Identification of 80+ functions, libraries, and security vulnerabilities through unknown executable analysis
• Forensic image and file system creation and inspection using Procmon and PeStudio

Impact

The Problem

Modern applications don't have a single attack surface. They have many. A web app can be hardened while the API it talks to leaks data. A container can be locked down while the mobile client it serves has unencrypted communications. Application security engineering means understanding the full stack and knowing where each layer breaks down under adversarial pressure. These five projects were designed to build exactly that: comprehensive, layer-by-layer security intuition grounded in real remediation work.

What’s Included

• Identified and remediated 4 critical vulnerabilities (XSS, CSRF, SQL Injection, command injection) in a Django web application
• Implemented automated detection rules and security controls applicable to AI/ML API environments
• Security audit of an Android gift card application
• Fixed Intent vulnerabilities and implemented HTTPS encryption for REST API communications
• Removed privacy-invasive monitoring code
• Secured containerized applications using Kubernetes
• Implemented automated monitoring with Prometheus
• Established security controls applicable to AI/ML model serving environments
• Identified and fixed 6 buffer overflow and memory corruption vulnerabilities in a legacy C application
• Achieved 85%+ code coverage through systematic test case development using AFL++ fuzzer
• Implemented comprehensive API security controls and monitoring solutions
• Established foundation for securing AI model APIs and detecting anomalous usage patterns

Impact

Why

Most apps that handle sensitive data, from voice recordings to clipboard history to cycle logs, send a copy somewhere: a server, an analytics vendor, a cloud backup. Every copy is another place it can leak, be sold, or be handed over. Cycle logs show the stakes most plainly, since in the US, health data held by an app company can be subpoenaed.

Retrac Labs starts from the opposite assumption: the safest copy of your data is the only one, on your own device, and a privacy promise should be something you can check rather than take on faith.

What Shipped

• Apunte for Mac: transcription of recordings, calls, and meetings, run entirely on the Mac, with on-device summaries and a Touch ID lock
• Retazo for Mac: clipboard history that skips password-manager copies, lets one-time codes fade after five minutes, and strips tracking tags from links
• Amparo for iPhone: cycle tracking with no account or cloud, kept out of iCloud Backup by default, with Discreet Mode and an encrypted AirDrop transfer to a new phone
• Mac apps shipped without the outgoing-network entitlement, so their own code cannot open a connection, which anyone can confirm with codesign
• Product, design, engineering, and App Store releases, from first commit to shipped update

Impact

Check It Yourself

Every Mac app declares what it's allowed to do, and Apple signs that declaration into the app. Anyone can read it. Here's Apunte 1.3:

$ codesign -d --entitlements - --xml /Applications/Apunte.app | plutil -p -
{
  "com.apple.application-identifier" => "2JC8Y26788.com.retraclabs.apunte"
  "com.apple.developer.team-identifier" => "2JC8Y26788"
  "com.apple.security.app-sandbox" => true
  "com.apple.security.device.audio-input" => true
  "com.apple.security.files.user-selected.read-only" => true
  "com.apple.security.files.user-selected.read-write" => true
}

Apunte asks for the sandbox, the microphone, and files you choose. Retazo 2.1 asks for the sandbox and files you choose. Neither carries com.apple.security.network.client, the entitlement a sandboxed Mac app needs to open a network connection, so neither can send what it holds anywhere.

Amparo's Threat Model

Cycle logs are the most sensitive data any of these apps holds, so Amparo is designed around who might want them:

• A company or server holding your data, through a breach, a sale, or a subpoena: Amparo has no account and no server, and its code makes no network requests of its own, so there's no copy to hand over. Its data is kept out of iCloud Backup by default.
• Someone glancing at your phone: Discreet Mode covers notifications and the Lock Screen, alternate app icons don't look like a cycle tracker, and Siri keeps quiet about your cycle while the iPhone is locked.
• The move to a new iPhone, intercepted or AirDropped to the wrong person: the transfer file is sealed with AES-GCM under a key derived from a 12-character one-time code (60 bits) through 600,000 rounds of PBKDF2-HMAC-SHA256. The code appears only on the sending iPhone, and the file's header is bound into the seal, so an altered file won't open.
• History piling up: Keep My History deletes entries older than a period you choose.

Out of scope: someone holding your unlocked iPhone, or a compromised device. And if you turn iCloud Backup on for Amparo, your data is then protected by Apple's backup, not by Amparo.

The Problem

Public law infrastructure has a trust problem: when governments publish legal documents online, there's no guarantee that the content hasn't been tampered with by bad actors, accidental overwrites, or repository changes. Open Law Library's TAF (The Archive Framework) adds a Python-based layer over TUF (The Update Framework) to cryptographically authenticate law repositories hosted on GitHub.

The challenge is that engineering and operations teams weren't consistently using the security tooling, and the vulnerability process management lacked the structure needed to catch and remediate issues before they reached production, thus putting the integrity of law served to 40,000+ users at risk.

What’s Included

• Documentation and reporting workflows designed to drive adoption of security tooling across engineering and operations teams
• Operational security tooling maintenance ensuring continuous verification of code commits on public law hosting infrastructure
• Vulnerability triage and remediation tracking aligned to internal SLAs
• Risk assessment reporting built from aggregated vulnerability and system data across application and infrastructure environments

Impact

The Problem

Enterprise infrastructure is only as secure as its weakest component. City National Bank needed adversarial eyes on its systems. Not just automated scans, but human-led penetration testing that could uncover the kinds of vulnerabilities that slip past conventional monitoring. The challenge wasn't just finding issues, it was translating deeply technical findings into risk-based language that both security teams and executive stakeholders could act on, while keeping vulnerability management continuous rather than episodic.

What’s Included

• Adversarial testing and vulnerability assessments across enterprise infrastructure
• Risk-based remediation recommendations translated for both technical and executive audiences
• Vulnerability scanning, detection, and monitoring system operations
• Cross-functional prioritization of vulnerabilities by risk, exploitability, and asset criticality
• Incident response and threat analysis including malware payload analysis and email investigation
• MITRE ATT&CK-aligned TTP identification using Wireshark and supporting security tooling

Impact

The Problem

A virtual simulator for PSL had been in development for several years to give operators experience conducting test runs before stepping into the actual control room. The work aimed to ensure accurate replication of complex operational environments.

My project added the heater on the 450-lb airline to the simulator, emulating the addition of fuel into the heater to heat the air on its journey to its designated test cell.

What’s Included

• Mass flow and temperature relations for the 450-lb airline heater, worked into three candidate equations
• Each equation tested against actual data from a 2009 PSL test run, keeping the one that best represented it
• The chosen formula adapted into code for the simulator, so it emulates fuel added to the heater to heat the air
• Thorough testing and analysis to ensure accurate replication of complex operational environments
• Data analysis and pattern recognition of propulsion system behavior, with engineering teams, to identify trends and anomalies in performance data
• A paper detailing the processes, calculations, scalability, and results of the simulator addition

Impact

The Problem

Managing IT assets, software licensing, and user access across 18 geographically dispersed government career centers is a coordination problem as much as a technical one. Without centralized visibility, hardware went underutilized, licensing costs ballooned, and security and compliance standards were applied inconsistently across locations. There was no single source of truth for asset lifecycle, system usage, or access controls: making risk assessment, remediation, and reporting largely reactive.

What’s Included

• Live dashboards and KPIs for IT asset inventory, system usage, and lifecycle tracking across 18 centers
• In-house systems for software licensing and hardware usage tracking
• End-to-end IT asset lifecycle workflows including provisioning, de-provisioning, and end-of-life management
• User access management and periodic access reviews for OSCAR, RAPIDS, WorkForce WV, DMV, and related applications
• Standard operating procedures and user access documentation
• Automated solutions for process improvement and federal/state compliance
• Technical support and training for staff and management across all regional centers

Impact