Refresh-token rotation with theft detection
How I designed an auth flow that detects stolen refresh tokens within a single round-trip — and revokes the entire session family the moment reuse is observed.
Managing Director and CTO leading engineering teams to build robust, scalable backend systems. I architect enterprise platforms from the ground up with security as a first-class concern.

Open to MS research collaborations, security engineering roles, founding-team conversations, and thoughtful intros.
▸ Levels represent honest diagnostics. If listed, it has been shipped to production environments.
Honest progress, not certifications-as-trophies. I learn by building deliberately vulnerable systems, then hardening them.
Builder → engineer → security engineer → founder. Each step compounding.
Long-form writeups on architecture, security tradeoffs, and database decisions. Built for engineers who want the actual reasoning, not the highlight reel.
How I designed an auth flow that detects stolen refresh tokens within a single round-trip — and revokes the entire session family the moment reuse is observed.
Choosing between schema-per-tenant, row-level isolation, and database-per-tenant. The tradeoffs I picked for an LMS that scaled past 10k concurrent users.
Rate limits, idempotency keys, request signing, and structured error envelopes. The defaults I wish every API tutorial taught.
Moving auth, rate limiting, and cache invalidation to the edge — what works, what doesn't, and where you still need a traditional origin.