I'm an independent generalist technologist with an interest in open source vulnerability management and related software supply chain security.

Most recently, I've worked as a Software Engineer on Google's Open Source Security Team (GOSST) working onOSV.dev.

I'm passionate about a solid foundation of machine-readable vulnerability metadata for known vulnerability detection/remediation/prevention (aka "management").

• 🔭 I’m currently working onOSV Schema level things as a community contributor to theOpenSSF's Vulnerability Disclosures Working Group and systemic CVE data quality initiatives via theCVE Program's Quality Working Group (QWG)
• 🌱 I’m currently studying aBachelor of Psychological Science and Counselling at ACAP University College
• 💬 Ask me about my feelings on CVE aggregate data quality/completeness/fitness for purpose
• 😄 Pronouns: he/him
• ⚡ Fun fact: I've been a Linux Systems Administrator, Site Reliability Engineer (Systems Administration), Security Engineer and Software Engineer at Google, spanning two decades in Mountain View, CA and remotely in Brisbane, Australia

PinnedLoading

1. ossf/osv-schemaossf/osv-schemaPublic

   Open Source Vulnerability schema.

   Go 230 111

2. google/osv.devgoogle/osv.devPublic

   Open source vulnerability DB and triage service.

   Python 2.5k 278

3. google/osv-scannergoogle/osv-scannerPublic

   Vulnerability scanner written in Go which uses the data provided by https://osv.dev

   Go 8.4k 521

4. github/advisory-databasegithub/advisory-databasePublic

   Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

   2.1k 527

5. mprpic/cvelintmprpic/cvelintPublic

   CLI tool to validate CVE v5 JSON records.

   Go 12 3

6. ossf/wg-best-practices-os-developersossf/wg-best-practices-os-developersPublic

   The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

   JavaScript 987 186