Working with AI
Two threads. AI is my pair programmer and orchestrator — it helped me build a privacy-first journal app end to end and run a ten-round penetration test against it. And where it earns its place in a product, I build it in: opt-in, on-device by default, cloud only when a user explicitly chooses it. Either way the rule is the same — ship it, then verify it actually does what it claims.
Method
It answers questions I haven’t formed yet — diagnosing a deadlock in one pass, then explaining why it deadlocks so the mental model sticks.
I drove a ten-round penetration test from one terminal: the AI read the whole codebase, wrote exploit scripts, ran real tools across a Kali/Windows/Ubuntu lab, and fixed findings in-session.
Several investigations run in parallel — one on the network protocol, one on how keys are wiped from memory, one on access control — then the findings get pulled back together.
A fix is new, untested code. I attack my own fixes round after round until an independent hunt comes back clean — that’s how I caught an “encrypted at rest” feature that had never actually engaged.
Force multiplier
AI-assisted development is how I actually ship — here's the work that documents it.
I'm a generalist, not a specialist — and for the first time that feels like an advantage instead of an apology. How AI changed what one IT person can actually do in a day.
ReadHow I went from a templated Wix site to an owned, fast, markdown-native stack — thought to design to a live cutover — in about a day, with AI as the pair programmer and me making the calls.
ReadAn authorized, ten-round penetration test of MoodHaven Journal — 65+ targets, 41 confirmed-and-fixed vulnerabilities, and the bespoke tooling it took to prove the encryption actually holds.
ReadBuilding MoodHaven Journal from scratch as a non-developer — zero-knowledge encryption, a Wear OS companion, peer sync, and what it actually takes to learn while you ship.
ReadIn the product
Opt-in, on-device first, cloud only on explicit consent.
A consent-tiered dictation and reflection pipeline: local filler-word cleanup always on, optional on-device polish via Ollama, and OpenAI only with explicit BYOK consent. On-device sentiment detection, and Oura health context sent as qualitative descriptors only — raw biometrics never leave the device. Every AI feature is opt-in.
A browser-based game exploring game design and AI-driven mechanics, built with TypeScript and PixiJS.