Breaking systems
to build resilient ones.

Contributing to gittuf, an open-source supply chain security framework for Git built on TUF, incubating under the Linux Foundation's OpenSSF

Shipped multiple contributions fixing bugs in core RSL synchronization logic, annotation entry numbering, and silent error swallowing in commit operations

Completed a full docstring audit across ~55 command files to improve codebase documentation and developer onboarding

Investigating RSL annotation authorization as a liveness and DoS vector, supporting server-side implementation work under mentorship from a PhD student

Conducting structured code reviews using a three-layer framework: DCO/CI compliance, technical soundness, and code quality

Supporting career services operations and program management using CareerLink (12Twenty), ASU's enterprise career management platform

Produced a 20-page job market research report analyzing employment trends and hiring patterns for international students, serving dual audiences of students and employer partners

Collaborating with program managers and associate directors on events, systems access, and student-facing initiatives

Conducted a pre-start security assessment of the production web platform and internal Next.js monorepo, uncovering 8 confirmed findings across HIGH, MEDIUM, and LOW severity tiers

Audited the full application stack (Next.js App Router, Supabase, Drizzle ORM, Sanity CMS, Stripe, Cloudflare/Vercel) for misconfigurations, insecure data flows, and exposed attack surfaces

Delivered a structured vulnerability report to the CEO with remediation recommendations, prioritized by exploitability and business impact

Performed ongoing PR security reviews to catch regressions and enforce secure development practices across the engineering team

Implementing ZkLoRA: a zero-knowledge proof system for verifiable LoRA fine-tuning, enabling cryptographic proof that AI model adaptation occurred correctly without revealing model weights

Built a full backward pass stack with 8 ZK gadgets including SoftmaxBackward, GELUBackward, RMSNormBackward, AttentionBackward, and SGDOptimizer using the emp-zkml framework

Developed end-to-end training step tests at distilGPT2 scale, debugging activation range errors through weight initialization scaling

Research bridges zero-knowledge proof systems with practical ML deployment for trustworthy and verifiable AI

Designed and executed a security benchmark for AI-generated web applications, attacking 12 LLM-generated apps across 5 attack scenarios using a custom Playwright-based exploit verification pipeline and CAF metric

Key finding: security failures concentrate at integration boundaries rather than isolated logic, with missing rate limiting as the dominant vulnerability class across all prompt strategies

Worked on an evaluation framework for MCP server security (the tool-use protocol powering LLM agents), helping identify no-box attack surfaces including prompt injection via malicious tool descriptions and cross-agent trust boundary violations

Conceptualized and developed 10+ responsive web pages using ASU's branded design system, enhancing mobile usability and increasing user engagement

Conducted 20+ user research interviews and usability tests, leading to improved navigation flow and reduced bounce rates across redesigned pages

Oversaw front-end, back-end, and design efforts across UC's entire web portfolio, streamlining content workflows and accelerating site update processes

Designed and optimized user-facing features using Next.js and React, resulting in a 30% reduction in page load times and improved user engagement across platforms

Collaborated with cross-functional teams to integrate front-end components with back-end APIs, ensuring seamless data flow and consistent feature delivery across deployments