Projects

Open source I build and maintain — platform tooling, distributed-systems libraries, and security utilities. Everything here is shipped, versioned, and in use.

Flagship

Ditto

Ephemeral database copies with real schema, real data shape, and no shared state

Go

A Go CLI and shared-host service that gives every developer and CI job a disposable copy of production-shaped data. PII scrubbing is baked into the dump step, access is secured with OIDC or static tokens, and a warm copy pool keeps provisioning down to seconds. The goal: keep real production data out of laptops and CI logs entirely.

  • PII scrubbing at dump time — sensitive data never leaves the source boundary
  • Shared-host API keeps dumps fresh and refills warm copies automatically
  • OIDC bearer or token auth for team deployments
  • Multi-platform releases with Homebrew tap and three language SDKs

Distributed via Homebrew · deb/rpm/apk · Go, Ruby & TypeScript SDKs

Developer ExperienceData SecurityPII ScrubbingOIDCDockerCI/CD
GitHub

JetStream Bridge

Exactly-once NATS JetStream pipelines for Rails

Ruby

A production-ready bridge implementing the transactional outbox and idempotent inbox patterns for Ruby on Rails — with dead-letter queues, overlap-safe stream provisioning, and mock NATS for infrastructure-free tests. Documented down to a least-privilege permissions guide for locked-down NATS deployments.

  • Transactional outbox + idempotent inbox for exactly-once delivery
  • Runs under restricted NATS permissions (auto_provision=false) with a dedicated least-privilege guide
  • Rails generators, migrations, and health checks included

Distributed via RubyGems

Event-DrivenOutbox PatternExactly-OnceRailsNATS
GitHub

NatsPubsub

Declarative pub/sub for NATS JetStream in Ruby and TypeScript

Ruby · TypeScript

Cross-language messaging with full Ruby ↔ TypeScript interoperability: durable pull consumers with exponential backoff, DLQs, middleware pipelines, hierarchical wildcard topics, and automatic stream topology management. Published to two package registries with a full documentation site.

  • Identical semantics across Ruby and TypeScript implementations
  • DLQ, retry with exponential backoff, and schema validation built in
  • Docs site with Kubernetes deployment and performance-tuning guides

Distributed via RubyGems · npm

MessagingDistributed SystemsCross-LanguageNATS
GitHubDocumentation

AV Scanner

Supply-chain compromise auditing for GitHub organizations

Python

A security CLI built in response to the 2026 axios npm supply-chain attack. It sweeps commit and PR patches across repos, whole orgs, or property-filtered subsets, detects known-bad versions and IOCs, and emits a timestamped Markdown audit report with first-seen dates, risk levels, and remediation steps.

  • Scans explicit repos, entire orgs, or custom-property-filtered fleets — including private repos
  • Pre-filters targets by language stats and lockfile presence, down to nested monorepo packages
  • Audit-ready Markdown reports with IOC matches and remediation guidance
SecuritySupply ChainIncident ResponseGitHub
GitHub

ScribeCloud

Serverless translation platform on AWS, defined entirely in Terraform

Terraform · HCL

Terraform modules for S3, Lambda, IAM, and API Gateway with a Cognito JWT authorizer, plus a CLI that handles Cognito Hosted UI login and token caching. A compact, end-to-end example of least-privilege IAM and managed-auth patterns on AWS.

  • Module-per-service Terraform layout with least-privilege IAM roles
  • API Gateway HTTP v2 secured by a Cognito JWT authorizer
AWSTerraformIAMCognitoServerless
GitHub

Dotfiles

Reproducible macOS setup with security-conscious defaults

Shell

Version-controlled machine setup with hardened defaults, quality CI, and one-command reproducible installs. The same care applied to production infrastructure, applied to the workstation.

  • CI-tested installation on every change
  • Security-conscious defaults out of the box
AutomationSecurity DefaultsCI
GitHub

Upstream Contributions

floci-io/floci

Added an option to disable k3s's bundled CNI in EKS emulation — merged upstream into the open-source local AWS emulator.