End-to-end DevSecOps pipeline wrapping the intentionally vulnerable OWASP Juice Shop. GitHub Actions layers container image scanning (Trivy, Grype), DAST (OWASP ZAP), SAST (Semgrep), secrets detection (Gitleaks), and IaC linting (Checkov) — all exported as SARIF reports and SBOMs surfaced in GitHub's security dashboard. The full attack surface spans 13,000+ components continuously audited on every push.

TLS client/server chat application with CA/TTP-issued RSA X.509 certificates. Uses RSA-OAEP–wrapped AES-256-CBC session keys, HMAC-SHA256 message integrity, RSA digital signatures for authentication, and PBKDF2/AES-256–encrypted private key storage. Messages and user accounts are persisted in SQLite3.

Recursive DNS resolver supporting IPv4/IPv6 (A/AAAA), mail (MX), and authoritative (NS/SOA) record types, with response caching and multi-threaded concurrent query handling. Built from raw sockets to understand TCP/IP, DNS, and DHCP protocols at the wire level.