I build small, inspectable security tools around failure modes I can actually reproduce. These two implementations focus on binary hardening and API authorization under concurrency. Each has source code, automated tests, a threat model and explicit limits. No unexplained scanner score, borrowed customer results or pretend production metrics.
Rust / Verified testsLocal implementation
ELFGuard
Offline ELF64 hardening analysis
I built a zero-dependency Rust analyzer for ELF program headers and dynamic linking metadata. It finds executable-stack declarations, writable/executable load segments, PIE evidence and partial/full RELRO without loading or executing the binary.
cargo test --offline: 6/6 library tests passed on Apple Silicon, including 10,000 deterministic mutated ELF inputs without parser panic.
I built a loopback-only Go HTTP regression harness that demonstrates broken object-level authorization and concurrent replay, then proves the corresponding enforcement paths reject cross-tenant writes and apply a logical mutation once.
go test -race ./... and go vet ./...: passed on Apple Silicon.
The security boundary matters more than the language
The Rust tool is deliberately offline: it inspects untrusted binary metadata without executing it. The Go harness uses a controlled local HTTP target and compares vulnerable behavior against a fixed authorization model. Neither is an internet scanner or a production intrusion-detection system. I would rather show the exact failure and its test than inflate an experiment into a platform.
