I’ve always learned by building.

Built after conventional phone-transfer tools struggled with a 140 GB media library. The native SwiftUI app and companion shell script preserve originals byte-for-byte, recover from ADB disconnects, and safely resume interrupted jobs.

• SwiftUI
• USB + wireless ADB
• Resumable transfers
• macOS 13+

Turns scattered conference submission pages into a repeatable planning workflow. The static dashboard covers speaking, training, workshop, and volunteer deadlines while keeping private notes and saved plans in the visitor’s browser.

• Static architecture
• Curated CSV dataset
• Local-first state
• Filtered export

Holds the account-level community and sponsorship configuration shared across JavanXD repositories, keeping funding links and public profile conventions in one maintainable place.

• Sponsor links
• Account defaults
• Repository metadata

The source for the GitHub profile landing page: a compact orientation to current security work, open-source projects, conference activity, teaching, and ways to support ongoing maintenance.

• Profile README
• Pinned project guide
• Current work

A practical bridge between the Trusted Types specification and real adoption. It explains report-only rollout, policy design, default-policy migrations, browser sanitisation APIs, Perfect Types, violations, and fallback strategies.

• CSP rollout
• Safe DOM patterns
• Live playground
• Polyfill notes

A realistic support-ticket application built as a benchmark target for agentic penetration-testing systems. Authentication, role-based access, ticket workflows, attachments, search, administration, logs, and debug tooling provide a repeatable environment for measuring how agents investigate and report security findings.

• Agent benchmark
• Node.js
• SQLite
• Docker

A deliberately small login backend used to make SQL injection mechanics visible without a large application getting in the way. Intended for controlled education and security testing only.

• Node.js
• SQL injection
• Login flow
• Security education

A realistic nightlife guest-list application designed around an exploit, test, defend, and re-test learning loop. Includes attack scripts, CSP reporting, challenge guides, Docker support, and insecure-practice detection helpers.

• Node.js
• Docker
• CSP reporting
• Semgrep

Parses German delivery emails from Amazon, DHL, and DPD into one household sensor, merging duplicate notifications by tracking number and exposing structured attributes for dashboards and automations.

• IMAP parsing
• Duplicate merging
• HA sensors
• Push automations

Generates one to 365 valid puzzles across three difficulty levels, renders their solutions, remembers preferences locally, and can copy puzzle sheets or answers as PNG images.

• Three difficulties
• PNG clipboard export
• Batch generation
• localStorage

A self-hostable Amazon price guard: users register with an email address, save product URLs and target prices, review price history, and receive an email when a product drops below the chosen threshold.

• PHP + MySQL
• Scheduled checks
• Email alerts
• Android companion

The implementation companion to master’s research on web race conditions. A Firefox extension captures a request, a dispatcher coordinates parallel race routines, and ZAP tooling plus a vulnerable app support repeatable demonstrations.

• Firefox extension
• Parallel dispatcher
• ZAP extension
• Vulnerable lab

A practical collection of Pi-hole blocklists and an automatic update workflow, maintained to make network-level filtering easier to adopt and keep current.

• Pi-hole
• DNS blocking
• Shell automation
• 173 stars

Automates checks for TYPO3 access-control and security guidance so common configuration mistakes can be found consistently instead of relying on a manual review alone.

• Python
• TYPO3
• Access review
• Security automation

A focused browser add-on that adds random padding to outgoing requests, published as a small experiment in request-shape variation and browser extension development.

• Firefox add-on
• Request mutation
• JavaScript
• Published extension

A reusable R Shiny front end for exploring measurements stored on ThingSpeak, created as part of the broader HoneyPi sensor and visualisation ecosystem.

• R Shiny
• ThingSpeak
• IoT data
• Interactive charts

A compact full-stack example that reverses the usual recipe search: enter ingredients already on hand and discover cocktails that can be mixed with them.

• JavaScript
• PHP
• MySQL
• German UI

Adds server-side audience conditions to reusable HTML snippets in WordPress, allowing a site owner to inject content only when the configured targeting rules match.

• WordPress
• PHP
• Server-side targeting
• Reusable snippets

An R Shiny dashboard dedicated to exploring weight, temperature, and other measurements produced by connected beehive sensors.

• R Shiny
• Beehive telemetry
• Sensor charts
• HoneyPi

A controlled application that pairs an Angular front end with a Spring backend to demonstrate exploitation of the Jackson deserialisation vulnerability CVE-2017-7525.

• CVE-2017-7525
• Angular
• Spring
• RCE education

Small solution scripts for two OWASP Juice Shop exercises: brute-forcing Morty’s password and studying how CAPTCHA protection can be bypassed in a lab setting.

• OWASP Juice Shop
• Brute force
• CAPTCHA bypass
• JavaScript

A deliberately tiny PHP example that isolates HTML injection so the vulnerable data flow and its browser impact can be understood without unrelated framework code.

• PHP
• HTML injection
• Minimal reproduction
• Education