How publicly exposed Swagger and OpenAPI endpoints leak information in production APIs, and what actually reduces it.

• Thirteen sources: ten peer-reviewed papers plus OWASP, MITRE CWE and the OpenAPI specification
• Traced how specification-driven fuzzers turn a published schema into an attack surface
• Produced the risk framing the API Exposure Auditor was then built against

Research · OWASP API Top 10 · CWE-200 · Threat Analysis

An Express API served over HTTPS with its own TLS certificates, hardened with Helmet security headers, an explicit CORS policy and request logging.

• TLS terminated by the application itself rather than assumed from a proxy
• Secure defaults applied deliberately: headers, origin policy, audit logging
• Paired with a Cheerio scraper that normalises fetched pages into JSON

Node.js · Express · Helmet · TLS · Cheerio

A text classifier trained on a deliberately imbalanced spam dataset, judged on the metrics that survive class imbalance rather than on raw accuracy.

• Class weighting so the minority class is not simply ignored
• Assessed on ROC and precision-recall curves with confusion matrices
• Seeds fixed throughout, so a rerun reproduces the reported numbers

TensorFlow · Keras · NLP · scikit-learn

PySpark pipelines over multi-table flight and weather data, taking the same analysis from one machine to a distributed engine.

• SparkSession and cluster configuration tuned for the workload
• VectorAssembler feature pipelines feeding Spark MLlib classifiers
• MapReduce fundamentals implemented directly, not just called

PySpark · Hadoop · MapReduce · Spark MLlib

A database-backed PHP application with registration and login, sessions, content creation, search and an archive: about a thousand lines, no framework.

• Server-side validation on every route
• MySQL schema behind the create, search, archive and post views
• Shared header and footer components rather than copied markup

PHP · MySQL · JavaScript · Sessions

Dijkstra and A-star written from scratch in C over a custom graph structure, with a heuristic function and explicit closed-set tracking.

• No library containers: the graph, queue and sets are all hand-built
• Two search strategies over one structure, so their behaviour compares directly
• Built alongside binary search trees, hash tables and priority queues

C · Dijkstra · A-star · Data Structures

NotPetya and the Sony Pictures compromise traced from initial access to impact, with a response plan built on the Australian Cyber Security Centre template.

• Attack paths reconstructed from public incident reporting
• Man-in-the-middle attack analysis with practical defences
• Response plan mapped to a recognised national framework

Incident Response · MITM · ACSC · Forensics

A POSIX shell toolset for employee records: menu-driven search, add and delete, with log rotation and a user access-deny list.

• Portable POSIX shell rather than bash-only syntax
• Access control enforced through a deny list at the entry point
• Log management handled by the tool instead of left to grow

Shell · POSIX · Linux · Access Control

A Unity game with hand-written agent AI: A-star navigation across a generated node graph, seek and wander steering, and path-following agents.

• Node graph generated from the level rather than placed by hand
• Steering behaviours composed instead of scripted per enemy
• Shipped with a playable build and a development log

C# · Unity · A-star · Steering AI

Hides a message inside a carrier by encoding characters to binary and applying a multiplicative cipher over modular arithmetic, with a matching decoder.

• Encryption and extraction written as exact inverses of one another
• Keys chosen so each one maps reversibly across the symbol set
• Test cases written first, driving the implementation

Python · Cryptography · Modular Arithmetic