[ CORE ]
000%

FULL-STACK DEV · WEB SECURITY ANALYST

Wilson

Builds systems. Breaks them on purpose.

Computer Science graduate from the University of Port Harcourt. I build full-stack products end to end, then attack the same surface with OWASP-guided tooling before anyone else gets the chance to.

Two disciplines,

I've been shipping production software as a full-stack developer since 2021, and just as long, unable to leave what I build alone until I've tried to break it too.

one habit.

Most of my time goes into shipping real products, usually built with my core stack of SvelteKit, TypeScript, and Postgres. The rest goes into taking those same systems apart, using OWASP-guided penetration testing, and Defensys, my capstone project, which scores vulnerabilities with a trained classifier instead of a flat checklist.

What runs underneath.

Build

What ships
  • SvelteKit / Svelte 5
  • React.js
  • TypeScript
  • Tailwind CSS
  • Node.js / Bun
  • PostgreSQL (Neon & Supabase)
  • NoSQL (MongoDB & Redis)
  • Drizzle ORM
  • Vercel / Railway

Defend

What holds
  • OWASP Top 10 methodology
  • Web application penetration testing
  • Applied cryptography (AES-GCM, RSA-OAEP, ECDH)
  • Zero-knowledge auth design
  • DevSecOps / CI security tooling
  • Random forest classification (scikit-learn)
  • Web crawling & automated scanning
  • Security architecture & threat modeling

Shipped, then attacked.

2026

Redline

Full-stack · Browser extension + dashboard

A browser extension and dashboard for authorized penetration testing and bug bounty work — a payload library that reads the page you're on, passive recon over certificate-transparency logs, and severity-sorted PDF reports ready to submit.

  • Context-aware payload suggestions, the extension reads the live page and ranks categories against it instead of listing all ten
  • Passive recon via certificate-transparency lookups and header/markup fingerprinting, with SSRF guards on every server-side fetch of a user-supplied URL
  • Auth built on Better Auth for email verification, password reset, and rate-limited endpoints, hardened for real users rather than left on defaults
SvelteKitTypeScriptDrizzle ORMNeon PostgresBetter AuthManifest V3Brevo
2026

DefenSys

Final-year project · Full-stack · Security scanning platform

A web vulnerability scanner that runs real OWASP Top 10-guided checks (nmap, sqlmap, nikto, sslscan, gobuster, whatweb) and feeds the results through an AI triage layer that clusters and scores findings to cut out noise.

  • Automated scan pipeline across OWASP Top 10 categories: SQL injection, XSS, auth testing, header analysis, SSL/TLS, port scanning, API discovery, tech fingerprinting
  • AI triage layer (Qwen models via DashScope) clusters and scores raw findings, generating remediation guidance and cutting false positives
  • Full-stack platform with auth, per-scan dashboards, and exportable PDF reports — built as a tool a team could actually run in CI, not just a scan-and-print script
SvelteKitTypeScriptBunPrismaNeon PostgreSQLQwen / DashScope
2026

EndToEnd Encrypt

Full-stack · Security architecture

Secure file storage where the server never sees plaintext files or keys — encryption happens entirely client-side before a byte leaves the browser.

  • AES-GCM and ChaCha20-Poly1305 for file payloads, RSA-OAEP and ECDH for key exchange
  • Session auth (Argon2id + JWT) is cryptographically isolated from the client-side key-wrapping secret, therefore compromising the auth database exposes no path to decrypt stored files.
  • Argon2id and PBKDF2 for key derivation, soft-delete and listing endpoints on Neon Postgres
SvelteKitWeb Crypto APIjose (JWT)Neon Postgres

Security isn't a pass at the end. It's the same read, run twice.

Defensys, my capstone project, scans real applications against the OWASP Top 10 and scores findings with a random forest classifier trained to tell a genuine vulnerability from false positives. Built the way I'd want a scanner to actually behave inside a CI pipeline, not a lab demo.

  • 01 — Read as attacker

    Every feature gets probed the way an OWASP checklist would probe it, before it ships.

  • 02 — Score, don't guess

    Findings run through a trained classifier instead of a flat rules list, to cut noise.

  • 03 — Build the fix in

    Zero-knowledge auth, client-side encryption, race-safe writes: hardening as architecture, not as patchwork.

Let's build something worth attacking.

giddel100@gmail.com
GitHub ↗LinkedIn ↗Resume ↗
© 2026 Wilson Port Harcourt, NG