Security engineer. Running Thunkle, co-building Vibe App Scanner. Sharing app security, product decisions and what I’m building next.
Canada
Joined October 2025
- Tweets662
- Following311
- Followers218
- Likes3K
Pinned Tweet
I turn 30 today 🎂
here’s what I’m bringing with me from my twenties:
• spent 7 years working in private security
• built and sold a Shopify security app
• left my job and started a software dev agency
• built vibe app scanner to 5,500+ users & an appsumo launch
heading into my thirties, the goal is to build on that.
grow VAS. grow Thunkle. keep building new businesses. and share more of it here!
if you’ve already crossed 30, what’s one thing you’d tell someone starting this decade?
hugely inspired by @SoraiaDev! I built an n8n integration for vibe app scanner.
this one was fun to build and very cool to see an automation run from end to end.
Really cool to see @daveswift put VAS to the test. He planted a test Stripe key, VAS found it, then handed the findings to a coding agent and rescanned. I appreciated his honest take on the AppSumo deal too.
youtube.com/watch?v=ZJ3J2x8C…
Check the headers on your deployed app, not just your config file. Hosting and redirects can change the final response. Make an app-specific fix, then retest. Our free headers checker is a starting point, not a security certificate.
vibeappscanner.com/tools/sec…
Vibe App Scanner is live on @AppSumo! So excited to partner with them and offer a lifetime deal appsumo.com/products/vibe-ap…
An API key in a frontend isn't automatically a leak. Public client keys and privileged secrets are different. Check what it permits. A real exposed secret needs revocation or rotation, not just deletion from the next build.
vibeappscanner.com/supabase-…
A working login screen doesn't prove your data is private. On your own Supabase app, test signed-out access with dummy data. Fix permissions, then retest. VAS can help with automated checks, not replace a full access-control review.
vibeappscanner.com/supabase-…
jacob retweeted
Using Fable 5.1, we’ve elicited a decoding of a cipher that has been unsolved for 373 year, and listed as #28 on Klaus Schmeh’s (the most-published cryptology author in the world) “The Top 50 unsolved encrypted messages.”
The solution? Almost embarrassingly simple in hindsight.
🤖 Made with AI
vite, supabase, and a bolted-on auth library. across 1,215 live applications, that combination had a critical flaw 36% of the time. supabase on its own was 24%.
wrote an article about how statistically the least secure way to ship an app is the default saas starter pack: meetcyber.net/the-default-sa…
who has switched from claude to gpt and are happy they did it? i'm a claude fanboy and haven't even tried any other models but opus 5 is borderline unusable for me
