Henry Pacheco (H3n)

Setting up a clean Arch Linux workstation manually takes hours of error-prone configuration steps, frequently leading to environment drift, insecure firewall presets, and forgotten system daemons.

• • Domain-driven modularity: decoupled modules for system security, networking, power management, graphics, and core CLI utilities.
• • Safe dry-run execution: inspect commands and planned operations prior to applying any changes to the host operating system.
• • Session-based automatic backups: safeguards existing dotfiles and /etc configuration files before altering files.
• • Predictable logging & error handling: standardized exit codes and audit trails for reliable operations.

• • Idempotent shell scripting patterns designed to run repeatedly without mutating valid system state.
• • In-depth systemd service orchestration, daemon supervision, and firewall rule syntax with nftables.
• • Enforcing disciplined semantic versioning and detailed changelogs for systems tooling.

Accidental credential leakage (API keys, private tokens, certificates) and stale dependencies in Git repositories are leading attack vectors. Teams frequently lack lightweight, self-hosted audit runners that integrate into CI/CD pipelines without incurring costly enterprise SaaS overhead.

• • Gitleaks-compatible TOML rule engine combined with Shannon entropy filtering and heuristic keyword checks to eliminate false positives.
• • Deep Git history commit scanner (`--history`) analyzing added diffs (`git log -p`) to catch credentials introduced and deleted across past revisions with commit SHA and author attribution.
• • Granular baseline suppression framework (`.rsa-baseline.json`) suppressing accepted risks by evidence hash with optional expiration date checking.
• • Enterprise CycloneDX 1.5 JSON Software Bill of Materials (SBOM) exporter embedding standard Package URLs (PURL) for PyPI and npm ecosystems.
• • Multi-ecosystem dependency auditor supporting `poetry.lock`, `pyproject.toml` (PEP 621), `requirements.txt` (version ranges) and `package-lock.json` querying the OSV Batch API (`/v1/querybatch`).
• • FIRST.org compliant CVSS v3.1 vector calculator parsing raw metric strings into exact numerical base scores (e.g. 9.8), preventing silent CI gate bypasses.
• • Native OASIS SARIF 2.1.0 exporter populating findings directly into GitHub Code Scanning, accompanied by a reusable GitHub Actions workflow with strict HIGH/CRITICAL failure policies.
• • Comprehensive defensive hardening: rigorous anti-SSRF enforcement (blocking private IP ranges and cloud metadata), Git ref flag injection mitigation, and `SensitiveDataFilter` logging protection.

• • Designing modular static analysis engines capable of dual execution modes: async REST API daemon and headless CI runner.
• • Implementing mathematical CVSS v3.1 vector calculation algorithms, structured SARIF reporting, and standard CycloneDX 1.5 SBOM generation without external bloat.
• • Rigorous software assurance discipline: 91% test coverage with Pytest (74 tests), strict static type checking with Mypy, Ruff linting, and 0 known vulnerabilities validated by `pip-audit`.

Static image scanners (such as Trivy or Grype) detect package CVEs at build time but remain completely blind to runtime execution: a vulnerability-free image becomes an immediate host compromise vector if executed with --privileged, a bind-mounted Docker socket, unconstrained cgroups, or disabled seccomp syscall filters.

• • Decoupled Docker Engine API collector: streams runtime telemetry over Unix domain sockets into typed Pydantic v2 models without shell wrapping or CLI subprocess dependencies.
• • Modular CIS policy engine: evaluates 6 core rules featuring dynamic severity (differentiating read-write vs read-only socket exposure) and granular findings for memory, CPU, and PIDs.
• • Compliant OASIS SARIF v2.1.0 exporter: integrates runtime findings directly into GitHub Security / Code Scanning dashboards complete with CVSS scores, technical impact, and remediation steps.
• • CI/CD quality gate enforcement: configurable --fail-on flag returning standardized exit codes to fail builds or deployment pipelines upon detecting CRITICAL or HIGH misconfigurations.

• • Deep practical mastery of Linux kernel isolation primitives: unmapped user namespaces (UID 0 host inheritance), cgroups v1/v2 ceilings (mitigating OOM kills and fork-bomb denial-of-service via pids.max), capability bounding sets, and seccomp BPF syscall firewalls.
• • Disciplined automated security testing: 71 unit and integration tests delivering 100% coverage on rules, backed by a reproducible 3-container testbed (privileged, exposed, and hardened control).
• • Translating low-level container runtime state into multi-format developer tooling (Rich terminal tables, machine-readable JSON, and enterprise SARIF).

Mainstream messaging platforms (WhatsApp, Telegram, Signal) compromise user sovereignty by mandating phone numbers, storing message histories on cloud servers, or harvesting vast communication metadata. Furthermore, standard E2EE tools lack defenses against direct physical coercion, forensic metadata leakage in attachments, biometric voiceprint profiling, or passive ISP traffic analysis.

• • Zero-Knowledge Blind Relay Architecture: The FastAPI server is technically incapable of decrypting frames, storing messages, or retaining keys (formally proven in test_server_inability.py); all cryptography is strictly isolated in volatile client RAM without disk storage.
• • Anti-Forensic Defenses & Duress Decoy Room: In the event of physical extortion or coercion, entering PIN 9999, typing /duress, or pressing Ctrl+Shift+D triggers an instant in-memory key wipe and displays an innocent, fully functional university study group room.
• • Deep Metadata Scrubber & SHA-256 Hash Masking: Every attached image or file is stripped in memory of EXIF metadata, GPS coordinates, and camera device serials, replacing the filename with a cryptographic hash before transmission.
• • Real-Time Biometric Voice Scrambler: Web Audio API engine modulating vocal formants and pitch (Deep Pitch, Helium, Cyborg, Whisper) prior to encoding and encryption, defeating forensic acoustic identification and voiceprint profiling.
• • View-Once Ephemeral Media & Self-Scrubbing Clipboard: Media viewer with 7-second countdown, automatic anti-capture blur upon losing focus, and irreversible blob destruction; operating system clipboard auto-wipes after 30 seconds.
• • LSB Image Steganography & BIP-39 Passphrases: Capacity to inject confidential payloads into lowest-significant bits of carrier PNG photos, and back up 256-bit symmetric room keys using standard 24-word BIP-39 mnemonics with SHA-256 checksum verification.
• • Native Android App with OS-Level FLAG_SECURE: Kernel-level protection blocking hardware screenshots (Power + Vol-), screen recording malware, and task switcher snapshots, reinforced with User-Agent header spoofing.

• • Protocol engineering with mathematical proof of technical inability on the relay intermediary (Blind Relay).
• • Design of a strict fail-closed in-RAM lifecycle revoking Blob Object URLs and zeroing symmetric keys upon panic or disconnect.
• • Asymmetric key agreement via ECDH P-256 with visual 4-word Short Authentication String (SAS) for mathematical Man-In-The-Middle (MITM) defense.
• • Mitigation of side-channel attacks, acoustic voice fingerprinting, and packet-length statistical traffic analysis through periodic decoy traffic.

Organizations face an expanding internet-facing attack surface (orphaned subdomains, exposed services without strong encryption, permissive HTTP headers, and insecure DNS records vulnerable to email spoofing). Most existing EASM tools are expensive enterprise SaaS or intrusive scripts that lack protection against SSRF, DNS rebinding, and unauthorized scanning.

• • Passive Subdomain Discovery: Maps external attack surface by querying Certificate Transparency logs (`crt.sh`) without transmitting intrusive traffic to the target.
• • TLS/SSL Deep Inspection: Strict detection of obsolete protocols (`TLS 1.0`, `1.1`, `SSLv3`), weak cipher suites, certificate trust chains, and expiration telemetry.
• • Defensive HTTP Header Auditing: Rigorous compliance validation of modern security directives (`HSTS`, `CSP`, `X-Frame-Options`, `X-Content-Type-Options`, and `Referrer-Policy`).
• • DNS Email Hygiene & Anti-Spoofing: Syntax and policy inspection for `SPF` (flagging permissive `~all` or `?all`), `DMARC` (`p=reject`/`quarantine`), and `DKIM` selectors.
• • Async Port Scanner with Anti-DNS Rebinding: Pre-resolves IP addresses and binds direct TCP sockets at the IP level to eradicate DNS rebinding attack vectors.
• • Anti-SSRF Perimeter Hardening: HTTP client with hop-by-hop inspection across 3xx redirects, blocking private ranges (RFC 1918) and cloud metadata services (`169.254.169.254`).
• • Cryptographic Domain Ownership Handshake: Requires random TXT token verification (`_secuscan-challenge.<domain>`) before scans can be triggered on any target.
• • Security Posture Score Engine: Weighted mathematical scoring (0-100) with transparent risk letter grades (`A+` to `F`) and itemized deduction matrices.
• • Dual Executive & Standard Reporting: Executive Markdown summaries and native OASIS SARIF 2.1.0 exporter for GitHub Code Scanning and DefectDojo.
• • Container Hardening: Docker deployment running as unprivileged `appuser` (UID 1000) with PostgreSQL isolated within an internal private virtual network.

• • Engineering critical perimeter defenses: robust SSRF neutralization in async HTTP clients and low-level socket handling to mitigate DNS rebinding.
• • Architecting non-intrusive asset recon via Certificate Transparency and designing multi-factor security scoring algorithms.
• • Standardizing vulnerability findings under OASIS SARIF 2.1.0 and upholding disciplined test automation: 86 Pytest suites (100% pass) and zero CVE dependencies.