Kalipto

Learning to read an application the way an attacker would: how authentication, authorisation and input handling break, and how to describe a finding clearly enough to be acted on. Most of my time here goes into practice targets and reading write-ups.

• Web Security
• API Security
• Vulnerability Assessment
• Penetration Testing

Building small, useful things with language models — retrieval over my own documents, prompts that hold up when inputs vary, and agents that call tools instead of guessing. Running open-weight models locally to understand the tradeoffs against hosted APIs.

• OpenAI API
• Local LLMs
• RAG
• Prompt Engineering
• AI Agents

Replacing work I have done twice by hand with something repeatable. Mostly Python scripts growing into scheduled jobs, plus GitHub Actions for the build, test and deploy path.

• Python
• GitHub Actions
• Security Automation
• AI Automation

Getting better at building a whole thing end to end: a typed API, a schema that fits the problem, and an interface that stays fast and accessible on a real phone. Currently focused on Next.js with TypeScript, and FastAPI on the server side.

• TypeScript
• Next.js
• React
• FastAPI
• Node.js

Learning to run what I build. Containerising services, putting Nginx in front of them, deploying to a VPS, and understanding what PostgreSQL and Redis are each actually good at.

• Docker
• Linux
• Nginx
• VPS Deployment
• PostgreSQL
• Redis

The area where careful process matters most. Working with medical equipment — maintenance, equipment management and biomedical systems — and looking for the places where software could reduce manual, error-prone steps.

• Clinical Engineering
• Medical Device Maintenance
• Equipment Management
• Preventive Maintenance