Assume breach
Design for the day someone's already in.
Back to the galaxy
01 Cybersecurity
Your systems.Locked down.
From SQL injection audits to WireGuard VPN infrastructure and hardened Linux servers — I close the gaps before anyone finds them.
- 0
- Threats blockedthis session · simulated
- 99.99%
- Requests served cleanbehind the WAF
- <15min
- Avg. patch windowon critical CVEs
- 8
- live security toolson this page
02 The honest truth
NO SYSTEM IS 100% SAFE. SO I BUILD LIKE IT ISN’T.
Anyone who promises unbreakable security is selling something. Real security is defense-in-depth: assume breach, make every layer expensive to get through, and shrink the blast radius when something slips.
Layer defenses
Never one wall, always many.
Least privilege
Patch fast, monitor everything.
Newest methods
Use the newest methods — attackers do too.
03 Try It · Runs In Your Browser Nothing is sent anywhere
SECURITY, LIVE — NOT SLIDES.
Everything below is real and runs locally on your device — genuine cryptography via the Web Crypto API, real attack payloads neutralised in front of you. Nothing is sent anywhere.
Entropy0 bits
Strength—
Cracked in—
An offline attacker guessing 100 billion/sec. Length beats complexity — a long passphrase wins.
AES-256-GCM · key derived with PBKDF2 (100,000 rounds)
SHA-256 of the message
…
✗ Naive — innerHTML
✓ Hardened — escaped + CSP
Rendered as text. Script never executes.
✗ Naive — string-built query
✓ Hardened — parameterized
Your authenticator code
000 000secret: JBSWY3DPEHPK3PXP · algo: HMAC-SHA1 · 6 digits · 30s
The server runs the same maths and accepts the current code (and one step either side for clock drift).
Token (header . payload . signature)
Attacks
Scan from
Firewall rules · vps-01
?Run a scan to see what an attacker sees.
Nothing is opened or fetched — the link is only parsed, the way a mail filter or browser warning would.
04 Defense in depth
FIVE WALLS, NOT ONE.
Scroll inwards. Every attack has to get through every layer — and each layer stops a different kind.
- L1Edge
TLS 1.3 + HSTS, a WAF and per-user/IP rate limiting stop scrapers, brute force and known exploits before they reach a server.
Cloudflare · WAF · rate limits - L2Network
Zero-trust segmentation — no implicit trust. Admin panels and databases are only reachable over a WireGuard VPN with a kill-switch.
WireGuard · firewall · segmentation - L3Host
SSH keys only, fail2ban, automatic security patching and nothing running that doesn't need to.
Hardened Linux · fail2ban · auto-patching - L4Application
Input validation and output encoding everywhere, parameterized queries, a strict Content-Security-Policy and MFA with least-privilege roles.
OWASP · CSP · RBAC · MFA - L5Data
Encryption at rest, Argon2id password hashes, secrets in a vault and encrypted backups with tested restores.
AES-256 · Argon2id · vault · backups
05 OWASP Top 10 · 2021
THE TEN THAT GET EVERYONE — AND HOW I CLOSE THEM.
The industry-standard list of what actually breaks web apps. Click any to see the risk and exactly how I defend against it.
06 How I Keep It Secure · Newest Methods
THE HARDENING CHECKLIST I SHIP BY.
App & Code
- Input validation & output encoding everywhere
- Parameterized queries / ORM — no string SQL
- Strict Content-Security-Policy & security headers
- Argon2id / bcrypt password hashing
- SAST · DAST · SCA in CI on every push
Network & Access
- TLS 1.3 + HSTS, modern cipher suites
- WireGuard VPN, split-tunnel + kill-switch
- MFA everywhere · least-privilege RBAC
- WAF + per-user/IP rate limiting
- Zero-trust segmentation — no implicit trust
Ops & Response
- Secrets in a vault — never in code or env files
- Structured logging + real-time alerting
- Encrypted backups with tested restores
- SSH keys only · fail2ban · auto security patching
- Incident runbooks — rehearsed, not improvised
07 Defense In Action
WHAT A HARDENED SYSTEM SHRUGS OFF, DAILY.
0Threats blocked · session
99.99%Requests served clean
<15minAvg. patch window on critical CVEs
08 Contact Open to full-stack roles · Dresden / remote