I like working on problems where the obvious solution isn't quite enough.
Over the past few years, that has led me deeper into application security, developer tooling, and intelligent systems. At KraitLabs, we worked on an ASPM platform that brings together security signals from repositories, cloud infrastructure, containers, and domains. As part of that work, we began exploring new approaches to statically identifying vulnerabilities related to broken access control.
That exploration led me to build a static analysis system that discovers API endpoints across different backend frameworks, maps the functions reachable from each endpoint, and turns them into call graphs. We then built LLM-driven agents that reason over those graphs to trace user-controlled input, identify broken access-control paths, and uncover vulnerabilities that depend on application context rather than a single pattern.
Making these systems useful in production has been just as important to me as the research itself. I've worked on parallelizing analysis to reduce scan time by 80%, while also building the infrastructure needed to run bursty security workloads on Kubernetes and AWS, with automated provisioning, CI/CD, and GitOps deployments.
What keeps me interested is the space between research and engineering — taking an idea that works in a prototype, understanding why it works, making it reliable at scale, and eventually turning it into something people can depend on.
Outside of work, I'm learning Japanese and working toward JLPT N3. That interest eventually led me to build JPLens, a real-time on-screen translation tool for my own language learning. I like building the tools I wish existed.
