codeql

tree-sitter grammar for the CodeQL language

Generate CodeQL taint-tracking models for Go (along with tests) in a graphical UI

Focus SAST scans (with CodeQL) on just the changed parts of your monorepo, split up as you define

Managing GitHub Advanced Security (GHAS) Controls at Scale

A vulnerable node express server

Detecting prototype pollution vulnerabilities in JavaScript using static analysis

DISM Final Year Project, Security Software Tool Development, CodeQL Scanner

GitHub native DevSecOps CI/CD best practices include automated security testing, code analysis, and policy enforcement using GitHub Actions, coupled with secure IaC and container security measures. This entails managing secrets, enforcing access control, and implementing incident response and monitoring, all while fostering continuous learning.

F1App is a web application built with React that provides information about the current Formula 1 season. It allows users to view the race schedule, countdown to upcoming races, and see key race results.

I built this end-to-end DevSecOps pipeline to demonstrate how I’d run secure, observable, and automated software delivery in a real engineering organization — from commit to cloud, with zero secrets in version control and full compliance guardrails.

Dependency-free Node.js web vulnerability scanner: security headers, XSS, TLS and SARIF output for CI.

Generate comma-delimited (CSV) files for security reporting from SARIF output

Hawkeye Sterling — AML/CFT Entity Risk Assessment for DPMS, with an AI compliance advisor and operations console (static Netlify app, no build step).

🔗 Client-side tool that parses Shields.io <img> badge tags and wraps each one in a GitHub repo link using weighted heuristic matching. Supports org URLs, HTML/Markdown output, TTL caching, and 14 UI languages.

Testing CodeQL SQL injection queries

Modern TypeScript library starter — dual ESM + CommonJS builds via tsup, with Vitest, ESLint flat config, Yarn 4, and GitHub Actions CI + CodeQL.

Scripts to pack codeql

Sample Node.js Express API with 4 automated security gates in GitHub Actions — Snyk, Trivy, CodeQL, OWASP ZAP

Serverless REST API on Firebase with CI, automated tests, a deployed Go smoke check, and Slack alerting.

Basic backend for a social network.