Security engineering, open infrastructure, and AI evaluation for systems that should fail visibly, not silently.
mazzeleczzare.com · ORCID · Get in touch
Systems reveal themselves under pressure — that's the working premise behind everything in this profile. I build and test for observable state: security tooling, privacy-preserving infrastructure, and human-AI systems designed so that failure surfaces early instead of getting buried under a passing test suite.
Every project here is built against the same constraint: it has to work, be auditable, and be legible to people who aren't security engineers.
- Hardening privacy-first, local-first infrastructure (Meridian, mindful-dev)
- Building policy guardrails and integrity telemetry for agentic AI (praxis-aegis, stele)
- Extending forensic tooling and MCP-server infrastructure (git-forensics-agent, kairos-mcp)
- Writing on privacy infrastructure and human–AI collaboration
The load-bearing layer — the sites where the evidence checks out cleanly against the claims. Not a "best of," a "checked."
Evidence that doesn't run through my own repos. Two denial-of-service vulnerabilities found and reported in js-yaml's merge-key handling, plus a credited analysis contribution to a related disclosure — verified via GitHub Security Advisories, not self-reported.
| CVE | Severity | Finding |
|---|---|---|
| CVE-2026-59869 | High (7.5) | Quadratic CPU consumption via chained merge keys — js-yaml 3.x/4.x |
| CVE-2026-59868 | Moderate (5.3) | Quadratic CPU consumption via merge-key chains — js-yaml 5.x |
| CVE-2026-53550 | Moderate (5.3) | Repeated-alias merge-key DoS — credited as an analyst alongside five other researchers |
Three exposures, drilled from the same face. Expand a core sample to see what's in it.
Security & privacy infrastructure
| Project | What it does |
|---|---|
| secure-pride | Privacy-first cybersecurity tools and standards for LGBTQ+ communities and high-risk groups, built for adversarial conditions |
| git-forensics-agent | Zero-knowledge forensic case-file agent for adversarial git incidents — Durable Object brain, AES-256-GCM, HMAC-signed repair gate |
| mindful-dev | Claude Code pre-action safety gate — blocks dangerous commands, redacts secrets, guards shell access |
Trustworthy AI & agentic systems
| Project | What it does | Live |
|---|---|---|
| praxis-aegis | Trust-layer for agentic AI: policy guardrails and signing-aware controls for AI tool use | — |
| stele | Directive compiler and integrity telemetry — governance-as-code for AI-assisted work | stele.mazzeleczzare.com |
| context-synapse | Experimental engine for modeling how humans and AI systems negotiate context | — |
| adaptive-response | Schema-driven AI response engine — Cloudflare Worker + Zod-validated typed output, deny-by-default CORS | — |
Apps & product design
| Project | What it does |
|---|---|
| meridian | Privacy-first, local-first calendar for Apple platforms — Tailscale-only peer sync, no cloud |
| lockr | Privacy-first dating and social app for the LGBTQ+ community — E2E encryption, safety-first design |
| daedalus-switch | Identity & context switcher — one command switches VPN, terminal, browser, and filesystem context |
| platekit | Token-driven components for illustrated READMEs — divider, tag panel, card, cross-section, rendered offline via Playwright |
The instruments that show up across these sites, not a full résumé of tools.
Essays, technical notes, and research on privacy infrastructure, human–AI collaboration, and open-source systems thinking.
→ mazzeleczzare.com · ORCID 0009-0005-9661-4780
Software should be secure, humane, understandable, and accessible to people who aren't security engineers.
That's not a nice-to-have. That's the constraint every project here is built against.
Open to collaboration on privacy tooling, secure infrastructure, and human–AI systems — especially with researchers, independent builders, and mission-driven organizations.
Open an issue, or reach out directly.