DEFENSIVE SECURITY / DETECTION ENGINEERING / OPEN SOURCE
I investigate attacker behavior, build detections, and improve the tools that help defenders make better decisions.
Cybersecurity Engineer · Threat Hunting · DFIR · Security Engineering
| 01 / Detection | 02 / Investigation | 03 / Engineering |
|---|---|---|
| Detection logic, Sigma rules, telemetry quality and ATT&CK mapping. | Threat hunting, endpoint evidence, incident investigation and forensic workflows. | Reliable security tooling, tests, safer defaults and maintainable automation. |
I care about the distance between an event being collected and an analyst being able to act on it. Most of my work sits in that gap.
A few shipped fixes that illustrate the kinds of problems I work on. Each link goes to the actual accepted pull request.
| Focus | Contribution and why it matters |
|---|---|
| Detection fidelity | pySigma #585 — respect the rule's regex policy instead of silently forcing RE2. |
| Query correctness | Splunk Sigma backend #77 — correct Boolean precedence that could broaden generated SPL/SPL2 searches. |
| Threat-hunting coverage | Sysmon Modular #227 — correctly map WMI permanent subscriptions to MITRE ATT&CK T1546.003. |
| Forensic tooling | Volatility 3 #2035 — replace misleading Windows plugin crashes with actionable errors. |
| Security control lifecycle | Firewalla #9954 — ensure domain rules with IP TTL settings are properly removed. |
| Operational reliability | Yeti #1408 — fix dependency installation that prevented scheduled feed tests from running. |
| Endpoint workflow | Velociraptor #5086 — repair the VQL shell's Repeat action. |
Also contributing across Firewalla, DefectDojo, Nuxt UI, pySigma, and other maintained upstream projects.
120 accepted pull requests across 81 independent upstream repositories.
Every PR below is merged into the upstream project, not merely submitted from a fork.
Explore the complete contribution log — 120 merged PRs / 81 repositories
| Upstream | Latest merged change | Accepted PRs |
|---|---|---|
| Velocidex/velociraptor | Windows.System.Pslist: use the tracker's StartTime as CreateTime | #5075 · #5095 · #5086 · #5047 · #5016 |
| firewalla/firewalla | Keep the ipv4 entries of hostsdb in sync on Host:Updated | #9959 · #9954 · #9953 · #9910 · #9909 |
| SigmaHQ/pySigma | fix: compile |re values with the rule's policy | #585 · #545 · #544 · #542 · #541 |
| strictdoc-project/strictdoc | fix(traceability_matrix): skip included documents when listing nodes | #3255 · #3256 · #3243 · #3244 |
| caronc/apprise | Keep cc/bcc/reply display names intact in email url() | #1812 · #1813 · #1807 · #1808 |
| callowayproject/bump-my-version | fix: don't enable pip caching in the GitHub Action | #447 · #448 · #439 |
| eternnoir/pyTelegramBotAPI | Upload media files of rich messages | #2640 · #2639 · #2635 |
| ComplianceAsCode/content | al2023: map CIS 4.3.4 to sudo_remove_no_authenticate | #15167 · #15165 · #15164 |
| posit-dev/pointblank | fix: explain why col_summary_tbl() fails when no column can be profiled | #469 · #444 · #445 |
| Koenkk/zigbee2mqtt | fix(homeassistant): Use state_value_template for a switch overridden to a light | #33412 · #33410 |
| firecow/gitlab-ci-local | fix: evaluate spec:inputs:regex with RE2 like GitLab | #1974 · #1975 |
| DefectDojo/django-DefectDojo | fix(ui): show the line breaks of data-html popovers as text | #16395 · #16014 |
| SigmaHQ/pySigma-backend-elasticsearch | fix: strip empty "by with runs=N" from EQL temporal_ordered queries | #231 · #230 |
| career-ops-hq/career-ops | test(codeowners): count materialized skill entrypoints as links to the router | #5626 · #5051 |
| kaixxx/noScribe | Keep the translation folder valid for keys i18n loads later | #374 · #367 |
| yukinarit/pyserde | Reject non-mapping input when deserializing a dataclass from dict | #815 · #812 |
| yomidevs/yomitan | Ignore leading whitespace when looking up search queries | #2506 · #2504 |
| henriquesebastiao/downtify | Match titles with a dash against candidates with a feat. suffix | #435 · #434 |
| ydkhatri/mac_apt | Declare the BIOME Data column as text | #175 · #176 |
| coin-or/pulp | Keep binary bounds in nested add_variable_dicts and add_variable_matrix | #964 · #953 |
| Flexget/Flexget | Apply the session's max_retries to https:// requests | #5264 · #5263 |
| dgunning/edgartools | fix(search): drop an amendment form code whose root form is also listed | #1545 · #1533 |
| oauthlib/oauthlib | Dispatch reordered response_type values to the registered handler | #987 |
| JannisX11/blockbench | Fix new mesh faces getting a zero-size UV | #3830 |
| latent-spaces/brag | docs: quote optional audio map in gallery poster command | #63 |
| franciscoBSalgueiro/en-croissant | Fix board square of castling moves with check or mate | #953 |
| pythermalcomfort/pythermalcomfort | fix(jos3): add a t_core setter | #485 |
| abravalheri/validate-pyproject | Drop leftover Cirrus CI config and fix the linkcheck job | #335 |
| RDFLib/rdflib | fix: longturtle canon=True raised ValueError for a Dataset | #3584 |
| python/typeshed | [networkx] Accept any node type in graph functions that took Graph[Hashable] | #16557 |
| SumoLogic/pySigma-backend-sumologic | Fix cse_rule output format | #16 |
| ipython/ipython | Install ipykernel test requirements from its dependency group in downstream CI | #15418 |
| typstyle-rs/typstyle | fix: parse enum marker numbers as u64 | #520 |
| arviz-devs/arviz-stats | Reduce MAD over sample_dims in summary median kinds | #496 |
| mui/base-ui | [popover] Keep focus that moved elsewhere before the deferred focus restore | #6015 |
| komari-monitor/komari | fix(metricstore): give the ping queue its own capacity | #695 |
| fedora-infra/anitya | Use re.error instead of sre_constants.error (Python 3.15) | #2130 |
| quasarframework/quasar | fix(ui): compare the hash route path when releasing the iOS scroll lock #18573 | #18574 |
| falcosecurity/falco | fix(userspace/falco): recover file_output from a failed write | #4036 |
| BottlecapDave/HomeAssistant-OctopusEnergy | fix: Default "favour direct debit rates" to on when adding an account | #1918 |
| eugenioenko/ttt | fix(search): clear find highlights when closing find on a content tab | #950 |
| getsentry/spotlight | fix(dev): Run the sidecar with --experimental-strip-types for Node 26 | #1364 |
| Hexagon/croner | Fix previousRuns() for months shorter than 31 days | #409 |
| marcosschroh/dataclasses-avroschema | fix: compare union defaults with dataclasses.MISSING (Python 3.15) | #984 |
| florianfesti/boxes | TrayLayout: accept the escaped layout from the SVG command line | #977 |
| kucherenko/jscpd | fix(semantic): count a JSX element of a component as a call | #1211 |
| atuinsh/atuin | fix(config): let ATUIN_* environment variables override config.toml | #4438 |
| HKUDS/nanobot | fix(cli): set SPT_NOENV only on Linux | #6232 |
| lingui/swc-plugin | fix: transform a useLingui t nested in a placeholder of another t |
#285 |
| OHF-Voice/wyoming-faster-whisper | Constrain PyAV below 19 until faster-whisper supports it | #130 |
| unitaryai/detoxify | Drop pytest-flake8 from test requirements to fix CI on pytest 9 | #137 |
| olafhartong/sysmon-modular | Map WMI event subscription events (EID 19/20/21) to T1546.003 | #227 |
| open-jarvis/OpenJarvis | fix(speech): constrain PyAV below 19 for faster-whisper | #1094 |
| JFryy/qq | Stringify non-string YAML mapping keys (fixes #73) | #74 |
| pyxem/orix | Support Matplotlib 3.12 ArtistList location | #688 |
| Chocobozzz/PeerTube | Constrain PyAV when installing whisper-ctranslate2 | #7815 |
| orval-labs/orval | fix(core): do not alias self-referencing schemas in single schemas mode | #4298 |
| nuxt/ui | perf(useComponentProps): skip prop resolution for Vue internal flags | #7186 |
| boa-dev/boa | fix(engine): accept lone surrogate escapes in JSON.parse | #5578 |
| huggingface/speech-to-speech | Add an opt-in --torch_num_threads setting for PyTorch CPU threads | #707 |
| Oldcircle/geo-sleuth | fonts: find CJK fonts on Windows, allow a GEO_FONT override | #13 |
| volatilityfoundation/volatility3 | Windows: Raise TypeError instead of a bare raise in virtmap and crashinfo | #2035 |
| NetroScript/Graveyard-Keeper-Savefile-Editor | Read the Eel version with importlib.metadata (fixes #106) | #107 |
| sgl-project/sglang-omni | [ASR] Probe audio duration with PyAV 19 | #2557 |
| bacescuandrei/macos-inspector | Remove unused imports and variables | #1 |
| oreilles/polars-st | Fix import on Polars 2 (GeoSeries metaclass conflict) | #85 |
| datajuicer/data-juicer | fix(mapper): use the Lexbor parser in clean_html_mapper | #1085 |
| Kometa-Team/Quickstart | Skip no-commit-to-branch in the Lint workflow | #1878 |
| turbot/steampipe-mod-aws-compliance | Fix port ranges in vpc_security_group_restricted_common_ports query | #978 |
| arxhr007/Aliens_eye | Use the Lexbor parser of selectolax (fix ImportError with selectolax 1.0) | #23 |
| yeti-platform/yeti | Install the plugins dependency group in the feed tests workflow | #1408 |
| harry0703/MoneyPrinterTurbo | Constrain PyAV below 19 in requirements.txt | #1582 |
| Kometa-Team/Kometa | Report failed Apprise notifications with Apprise 2 | #3690 |
| wayne-csrs/pySigma-backend-signals | fix: keep correlation event_type unquoted with pySigma >= 1.5.1 | #9 |
| ipython/ipykernel | Update README install command for the test dependency group | #1573 |
| Softcatala/whisper-ctranslate2 | Constrain PyAV below 19 in the package requirements | #154 |
| nornir-automation/nornir | Deprecate legacy Jinja2 rendering helpers | #1103 |
| logpoint/pySigma-backend-logpoint | Fix AttributeError for numeric pipeline pre-filter values | #38 |
| SigmaHQ/pySigma-backend-crowdstrike | fix: OR nested inside AND was not parenthesized, widening the emitted query | #25 |
| SigmaHQ/pySigma-backend-splunk | fix: OR/AND precedence inversion widens emitted queries in SPL and SPL2 backends | #77 |
| benmoran56/esper | Fix _get_components() dropping a filter type when the min-size set changes twice | #124 |
Maintained automatically from verified GitHub merges. Latest: 2026-10-25 (UTC). Open and closed-unmerged PRs are excluded.
View the complete upstream history ↗
Yahoo IMAP Scanner / Local Mail Guardian ↗
A local-first phishing and spam analysis tool with explainable detection signals, a CLI and local web interface. Built around read-only scanning by default, explicit approval for mailbox changes, and privacy-conscious reporting.
- Reproduce before patching. Start with the observed failure, then write a focused test that would fail without the fix.
- Prefer precise changes. Small patches are useful when they resolve a real failure; complexity is not a measure of impact.
- Preserve security boundaries. Favor understandable defaults, testable behavior, and clear failure handling.
- Leave evidence. Link issues, tests, review discussions, and upstream acceptance rather than relying on self-reported metrics.
Defensive security, grounded in evidence.