Background

How I got here

I started with Python the way most people do — writing scripts to automate small tasks, solving logic problems, learning the syntax. But somewhere along the way, I got pulled into security. I started reading about how web applications get exploited, how attackers think, and how the tools they use are built. That changed how I write code.

Now every time I write a function, I think about what happens when someone sends it unexpected input. When I build a workflow that handles data, I think about sanitization and safe handling patterns. When I interact with web endpoints, I think about session security, authentication edge cases, and what a malicious request would look like.

This is not just a theoretical interest. I actively practice offensive security — testing for XSS, analyzing endpoints, automating recon workflows, and studying how real vulnerabilities are discovered and reported. I read books written for penetration testers and apply what I learn by building the tools described in them.

I am transitioning from writing individual scripts to building structured, reusable tools and systems. The scripts I wrote six months ago work, but they are not engineered. What I am building now has proper error handling, modular architecture, clean interfaces, and documentation. That is the shift I am in the middle of right now.

How I think about code

Security is not something I bolt on after writing the code. It is how I write the code in the first place. Input validation is not optional. Data handling is never assumed to be safe. Patterns that open the door to injection, path traversal, or unsafe deserialization are patterns I have learned to recognize and avoid.

I think with an attacker's mindset but I design with a defender's priorities. Understanding how something can break is the first step to building it right. That dual perspective is what separates security-aware development from just development.

My strongest skill right now is taking a manual, repetitive security workflow and turning it into something automated and repeatable. Whether that is enumerating subdomains, fuzzing parameters, or parsing response data for patterns — I can take the steps a researcher does by hand and encode them into a Python tool that does it faster, cleaner, and more consistently.