I build product code and study how software fails.

University of Maryland — College Park, MD

BACHELOR OF SCIENCE IN COMPUTER SCIENCE · AUGUST 2023 – MAY 2027

Relevant coursework: Computer & Network Security, Computer Systems, Algorithms

Lawly — Software Engineering Intern

REMOTE · MAY 2026 – PRESENT

• Authored 340+ commits on a Next.js / React / TypeScript marketplace (Fastify, Drizzle ORM, PostgreSQL, Stripe), shipping 47 REST endpoints and 33 additive schema migrations across payments, messaging, and access control.
• Designed and shipped Stripe idempotency keying across four checkout flows, eliminating duplicate-charge risk on retry while still allowing legitimate repeat purchases.
• Built end-to-end account erasure across schema, service layer, REST endpoints, and admin UI, and hardened privileged flows with actor-level audit logging, attempt lockout, and replay-resistant MFA and email verification codes.
• Wrote 169 test files and 1,367 test cases, including integration suites running against a real PostgreSQL instance covering payment math, refund eligibility, and erasure cascades.

READ THE CASE STUDY

CodePath — Tech Fellow

REMOTE · FEBRUARY 2026 – PRESENT

• Facilitated weekly breakout sessions for cybersecurity and technical interview prep courses, guiding students through hands-on labs, algorithmic problem solving, and debugging.
• Supported student development across data structures, Big O analysis, Linux, networking, and threat detection using Socratic questioning and real-time feedback.

Campus Coders Crew — Developer

COLLEGE PARK, MD · FEBRUARY 2026 – PRESENT

• Built full-stack web apps for UMD student organizations using React, Node.js, and TailwindCSS, designing REST endpoints and coordinating deliverables with a cross-functional team on an Agile / Scrum cycle.

CARLOS EMR — Open Source Security Contributions

JAVA / SPRING / JSP / JQUERY / DOCKER · 2 MERGED, 1 APPROVED

• Patched a stored XSS vulnerability by adding context-sensitive OWASP output encoding across 5 unescaped JSP locations, closing off arbitrary script execution on the document-edit form.
• Stripped PHI-correlating request bodies out of ticklerREST logging, swapping verbatim JSON for safe operational metadata so patient data no longer persists in application logs.
• Submitted a fix for a CSRF bypass in the tickler note dialog by switching a jQuery AJAX mutation from GET to POST, restoring CSRFGuard token validation and keeping clinical notes and patient IDs out of URLs and Tomcat access logs; reproduced all three issues in Docker.

READ THE CASE STUDYSOURCE

AI-Powered Cyber Threat Reporter

PYTHON / FASTAPI / REACT / POSTGRESQL / GEMINI / DOCKER · LIVE

• Built a full-stack threat-intelligence tool that takes text, URLs, and file uploads and returns AI-generated severity ratings with structured remediation steps, powered by Gemini.
• Secured the REST API with Supabase JWT auth, per-user rate limiting, and async PostgreSQL (asyncpg); wrote a batch log parser splitting files into parallel Gemini calls with rate-limit-aware throttling, deployed on Render via Docker with a React frontend on Vercel.

LIVE SITESOURCE