Ekene is a Senior AppSec & DevSecOps Engineer. He uses offensive thinking to engineer stronger systems: adversarial research, automated security controls, and verification that holds under pressure.
Offensive security is the input. Engineering is the method. Verification is the standard.
Offensive security, research, exploitation, and adversarial thinking.
AppSec, DevSecOps, architecture, automation, and supply-chain security.
Continuous testing, deterministic controls, regression testing, and autonomous discovery.
The Problem: Scheduled cron-rebuild models
leave windows of exposure between scans. Public base images carry stale vulnerabilities
and lack provenance, creating an insecure foundation for production APIs.
The Architecture: Engineered an event-driven pipeline using apko and
Wolfi base packages that automatically triggers multi-architecture rebuilds the moment a
fixable CVE drops. Each build is independently compiled, scanned (Trivy), signed
(Cosign), and attested with SLSA Level 3 provenance — all without human
intervention.
Impact: Zero critical CVEs in production. Base images reduced from
135MB to 45MB (66% reduction). Idle memory overhead dropped from 4–6MB to under 1MB.
Containers execute natively as uid/gid 1000 — no root.
graph TD
A[CVE Monitor] -->|Trigger| B[apko Build Matrix]
B --> C{Parallel Scan}
C -- AMD64 --> D[Trivy x86]
C -- ARM64 --> E[Trivy arm]
D & E -- Pass --> F[Cosign Sign]
F --> G[SLSA L3 Attest]
G --> H[Verified Gold Image]
H --> I[Event-Driven Deploy]
style H fill:#312e81,stroke:#818cf8
style A fill:#7f1d1d,stroke:#fff
The Challenge: Manual onboarding created "ghost
accounts" and delayed access revocation by up to 48 hours, risking compliance failures
and unauthorized access.
The Architecture: Engineered a fully automated lifecycle using Jira
Service Management, Okta Workflows, and JumpCloud. Access is granted based on Role
(RBAC) and revoked instantly upon contract termination via webhook-driven
orchestration.
Impact: Eliminated ghost accounts and reduced offboarding time from 48
hours to under 5 minutes.
graph TD
HR[Jira Service Mgmt] -->|Webhook| Okta[Okta Workflows]
Okta -->|Onboard| Prov[Provision AWS & JumpCloud]
Okta -->|Offboard| Kill[Revoke Sessions & Lock Device]
style Kill fill:#7f1d1d,stroke:#fff
The Problem: AOT-compiled and obfuscated
Flutter applications hide cryptographic operations behind native binaries, evading
standard Java-level interception tools and runtime instrumentation.
The Architecture: Built a Dual-Layer Discovery engine that combines
high-level JVM interception (javax.crypto, flutter_secure_storage) with native memory
pattern scanning. Integrated static AOT parsing via Blutter to mine data from object
pools, automating extraction of hardcoded keys, initialization vectors (IVs), and
platform MethodChannels.
Impact: Fully automated extraction of cryptographic material from
obfuscated Flutter binaries without manual reverse engineering.
graph TD
A[Flutter APK] --> B{Static Analysis}
B -- AOT Binary --> C[Blutter Parser]
B -- Dart VM --> D[JVM Hook]
C --> E[Object Pool Mining]
D --> F[flutter_secure_storage]
E & F --> G[Key/IV Extraction]
G --> H[MethodChannel Map]
style C fill:#312e81,stroke:#818cf8
style G fill:#7f1d1d,stroke:#fff
The Challenge: Modern Android apps use native
SSL implementations (BoringSSL) and the Flutter engine's built-in certificate validation,
requiring rooted devices or complex setups for traffic inspection.
The Solution: Created a rootless automation framework that performs
byte-level patch orchestration via reFlutter to permanently modify compiled native
binaries (libflutter.so), neutralizing BoringSSL validation structures. Standardized
output parsing generates SARIF auditing data mapped to OWASP MASVS risk
baselines.
Impact: Rootless SSL pinning bypass integrated directly into CI/CD
security validation workflows with standardized compliance reporting.
graph TD
A[Target APK] --> B{Binary Analysis}
B --> C[reFlutter Patch]
C --> D[Neutralize BoringSSL]
D --> E[Rootless Hook]
E --> F[Traffic Intercept]
F --> G[SARIF Generator]
G --> H[OWASP MASVS Map]
H --> I[CI/CD Report]
style C fill:#312e81,stroke:#818cf8
style H fill:#7f1d1d,stroke:#fff
The Challenge: Modern mobile apps use native
SSL implementations (BoringSSL) and Flutter's built-in certificate validation that
evade standard interception tools and proxies.
The Solution: Built an orchestration engine that combines static
pattern matching with Frida-based runtime instrumentation to bypass pinning in Flutter,
OkHttp, and custom TrustManagers. Supports both Java-level and native hook
strategies.
Impact: Automated SSL pinning bypass across diverse Android
architectures enabling comprehensive security testing without manual reverse
engineering.
graph TD
A[Target APK] --> B{Static Detection}
B -- Flutter --> C[Native Hook libflutter]
B -- Java --> D[Hook TrustManager]
C & D --> E[Runtime Bypass via Frida]
E --> F[Intercept Encrypted Traffic]
style E fill:#312e81,stroke:#818cf8
The Challenge: Standard SCA tools flag every
library vulnerability regardless of reachability, flooding teams with false positives and
creating alert fatigue.
The Architecture: Built a static analysis engine that parses abstract
call-graphs from application bytecode and cross-references them with SCA vulnerability
databases. Only reachable code paths are flagged, eliminating noise from dormant library
code.
Impact: Mapped 158K+ call-graph nodes in under 30 seconds. Validated
against WebGoat: 36 of 39 flagged CVEs were reachable — proving 3 were false positives
that standard tooling would have required manual triage to identify.
graph TD
A[App Bytecode] --> B[Call Graph Builder]
C[SCA Vuln DB] --> D{Reachability Engine}
B --> D
D -- Reachable --> E[Flagged]
D -- Unreachable --> F[Suppressed]
E --> G[Prioritized Report]
F --> H[Noise Eliminated]
style D fill:#312e81,stroke:#818cf8
style F fill:#065f46,stroke:#6ee7b7
I test the assumptions that sit between a valid request and a valid action. Recent assessment work spans identity, authorization, business state, session integrity, application-layer exposure, and the paths that connect them.
/investigate-code laneAutonomous AppSec graph pipeline built as a self-hosted four-node DAG: Mapper, Generator, Executor, and Validator. SQLite WAL state-machine contracts, Burp Suite MCP, and an architecture-aware FTS5 RAG/technique library coordinate deterministic testing with a zero-false-positive validation bar. The on-demand /investigate-code side lane turns source-level authorization and state-machine hypotheses into traceable, live-validated test cases.
Event-driven container security engine using apko/Wolfi with SLSA Level 3 provenance. Rebuilds, scans, and signs images automatically when fixable CVEs drop. 66% size reduction, rootless execution.
Universal Flutter cryptography interceptor combining JVM interception with Blutter AOT object pool mining. Automates extraction of hardcoded keys, IVs, and MethodChannels from obfuscated Flutter binaries.
Rootless SSL pinning bypass framework using reFlutter byte-level patching. Outputs SARIF auditing data mapped to OWASP MASVS risk baselines for CI/CD security validation.
Call-graph driven SCA engine that eliminates false positives by analyzing reachable vs. unreachable code paths. Benchmarked at 158K+ nodes in under 30 seconds on WebGoat.
Python-driven static and dynamic evaluation engine using Frida to hook OkHttp, custom TrustManagers, and Network Security Configurations.
Full-scale Kubernetes-based simulation of a banking environment for validating zero-trust architectures and simulating multi-stage attack vectors.
Technical workshops on ECS Fargate, RDS security, and Docker Hub integration patterns for scalable workloads.
Independent research on five-byte gRPC headers and HTTP/2 DATA frame mutations, testing stream-state desynchronization across reverse proxies and backend runtimes.
Kubernetes-native banking simulation using Kong route controls, PIN-reset rate limits, and pod NetworkPolicies to contain SSRF/RCE chains without blocking delivery. Contributed zero-trust infrastructure hardening to the community project as a practical environment for testing resilient security controls.
Delivered "Threat Modeling for Complex Ecosystems," detailing trust-boundary mapping, STRIDE/DREAD frameworks, and compensating controls for multi-tenant API integrations.
Designed practical lab topologies including VulnBank and trained 50+ students transitioning into offensive and defensive security roles.
Instructor for a 2-part offensive security training series using the Banking Infrastructure Lab to train professionals on multi-stage attack vectors, zero-trust validation, and defensive engineering patterns.
Co-authored and co-taught a practical security workshop connecting web application and wireless network risks. Led the web application security segment, covering selected OWASP Top 10 vulnerabilities, insecure authentication and access control, injection, security misconfiguration, vulnerable components, ethical lab demonstrations, and defensive practices including secure coding, HTTPS, and strong authentication. A co-tutor led the wireless security segment, covering Wi-Fi attack surfaces, network interception risks, and wireless hardening.
Have a system, pipeline, or security problem worth pressure-testing? Bring the attack surface. We will engineer the controls and verify that they hold.
Get in Touch