Now · updated 4 September 2026
What I'm working on
Everything below is in progress rather than finished, and it is dated so you can tell how stale it is. If a row here contradicts something on another page, this one is newer.
| Shipping | A Semgrep rule pack for the bug classes I keep finding — unscoped lookups by user ID, fail-open catch blocks, unverified webhook signatures. Four rules, each with a passing and a failing fixture. Next step is submitting them to the Semgrep Registry. |
| Building | ParkSense, a parking management system for Nairobi operators. Pre-pilot: it has not yet read a real number plate or taken a real shilling. Working toward the first site. |
| Writing | A post about two rules in that pack that were silently inert — invalid YAML meant they never ran, and I only found out by testing them rather than reading them. |
| Open to | Backend, platform and DevSecOps roles, and short application security reviews — authorization across tenant boundaries, payment and webhook paths. |
| Parked | Property management, school management and point of sale are all part-built and deliberately on hold. Three active projects is the limit that works for me. |