Product Designer
I build production software at Rebuildr. Outside it, I work inside other people’s systems (an open-source wiki’s API, a game’s creature behaviour) until I understand them well enough to change as little as possible. AI speeds up the investigation; it doesn’t make the decisions.
Product engineering at Rebuildr: shipping and maintaining software that people already use.
A published guide to operational security. Then a bug report in someone else’s codebase that became two merged fixes, and a lesson in how far one change reaches.
The game modification from the previous December became the most downloaded Alien: Isolation mod on Nexus Mods for the year.
Long, hands-on security labs: enumeration, lateral movement, trust boundaries. In December, a public release that changed how an existing game behaves.
What I noticed, what made it difficult, what I chose, and how I knew it worked. Each story links to its public evidence.
The route read page.descendantCount before checking whether the lookup had returned anything.
Land the rename fix first and on its own, as the maintainer preferred, and handle the duplicate route in a separate follow-up so that each review stayed small.
#11615 merged on 10 August 2026 and closed the issue.
The Alien’s behaviour is selected by a directive in the game’s ALIEN.BML data.
The published release sets that directive to NoBehaviour.
Released on Nexus Mods on 8 December 2024.
Shipping on a live product.
Production work on a live product: features, fixes, and the small decisions that have to keep making sense once they reach people.
Public boundary Described at the level of the work I do. Engineering stories from Rebuildr are published once they can be told without exposing private systems, customers, metrics, or plans.
Building from the other side of the table.
Starting from an idea, deciding what matters, and turning it into something real one careful decision at a time.
Public boundary Public notes stay high-level while this work is still being written up.
A null check, a client contract, and who gets to know a page exists.
Two merged fixes to the page API of GROWI, an open-source wiki platform. Found by reproducing a failure, shaped by maintainer review, and settled by a security property the first version of the fix had not accounted for.
2 merged Pull requests to growilabs/growi, July–August 2026
One directive. A different game.
An Alien: Isolation modification that changes one behaviour directive, and with it the whole experience of Sevastopol. The most downloaded Alien: Isolation mod on Nexus Mods in 2025.
Most downloaded Alien: Isolation mod on Nexus Mods in 2025
Find where the behaviour is actually decided, then change it there.
Seen in GROWIPeaceful Sevastopol
Leverage comes from placement, not from the size of the diff.
Seen in Peaceful Sevastopol
Scope is a decision. What stays untouched is part of the design.
Seen in Peaceful Sevastopol
Clients, translations, and security properties depend on behaviour a single route cannot see.
Seen in GROWI
Tests that exercise the real path, run more than once, beat an argument that the change is right.
Seen in GROWI
Split the work so each review can be about the behaviour, not the size of the diff.
Seen in GROWI
Continue
Longer writing on security and systems, the AI method in detail, and a direct line for engineering conversations.