Web applications that have to stay live. Laravel and PHP, application security, and AI features where they earn their place.
The booking system, the invoicing, the member portal, the report someone needs by nine in the morning. Built in Laravel or PHP, running on servers that get looked after. That software has to stay live, stay fast and stay secure while the business changes around it. This is the work I do, most days for the same client, for years.
Laravel and PHP on the back end, Vue and React on the front, Go, Node and Python where they suit the job. Feature work, refactoring, performance work, and framework upgrades staged to keep a site live throughout. Most of my clients are retained: they call when something needs building, because the system matters and they know how it will be handled.
I also do security work on the applications I already know. Reviews covering what is exposed, what is stale and what to fix first, then the fixes. Server hardening, hosting and email deliverability. My published research includes CVE-2026-110912, a kernel memory disclosure in DragonFly BSD, and the write-up is in the posts below.
And when AI is genuinely the right tool, I build that too. Retrieval over your own data, agents, fine-tuned models, inside the application your customers already use. I will tell you honestly whether AI is the right answer for a given problem.
25 open source models on Hugging Face with more than 450,000 downloads. 1,700+ hours billed with long-term clients on Upwork. Director of DreamFast Solutions Limited.
Send me a message. I work Australian business hours and reply fast.
CVE-2026-110912 is my first published CVE! The fix is merged upstream and the record is live in the database. It lives in a 23-year-old corner of DragonFly BSD. The ARP input path trusts two one-byte length fields from any packet on the wire. Ask for a 200-byte hardware address and the kernel builds its reply with a 200-byte memcpy out of a 6-byte buffer, and sends the excess back to you. Same trick on the protocol length reads straight off the kernel stack. One crafted ARP request on the same L2 segment leaks up to 249 bytes of heap and 251 bytes of stack, kernel pointers included. No authentication, and nothing in the victim’s logs.
Craft is a medium Hack the Box machine and the whole thing is one mistake repeated four times. A public Gogs server holds the API source, the git history holds a working password, and a private repository holds the developer’s own SSH key, protected by a passphrase I had already dumped.
The bug is one line of Python that runs eval() on the ABV value of a beer. Every wrong attempt came back with the same useless error and the correct one came back as a 500. Root came from HashiCorp Vault, which hands out one-time root SSH passwords to any source address.
Slayer is an easy Windows lab on Hack Smarter and it starts where most engagements end. A social engineering phase has already worked, and I am dropped in with a standard account and a working password on a Windows 11 build 26100 host. The win was a text file in the profile I already had. PowerShell logs every line you type, and whoever built this box set the local Administrator password from a session running as that same standard user. No exploit, one file read. Most of my hour still went into a privilege escalation that was not there at all.
Over a decade of Laravel and PHP, from internal tools to multi-tenant SaaS. Application architecture, APIs and data layers designed to be handed over and maintained.
Front ends in Vue.js and React, with Next.js and Nuxt.js where a project calls for them. Vanilla JavaScript, jQuery and SCSS where a site is better hand written.
Databases across MySQL, MariaDB, PostgreSQL and SQLite, with responsive, cross-browser delivery and a Git based workflow throughout.
Security reviews of PHP and Laravel applications: what is exposed, what is stale and what to fix first, then the fixes.
Vulnerability scanning across networks and software, server hardening, firewall configuration and ongoing monitoring.
Recovery work after an incident: cleaning and restoring affected sites, securing servers, and tightening what let the problem in.
Automated build and deployment pipelines using GitHub Actions, GitLab CI and shell scripting. Staging and production environments with automated testing, zero-downtime deploys and rollback strategies.
Containerisation with Docker for reproducible builds and isolated environments, so deployments are predictable rather than hand-tuned.
Server management across Debian, Ubuntu, CentOS/Almalinux, and BSD operating systems, including WHM/cPanel setup. Web server expertise covers Apache2, NGINX, and Caddy with load balancing and reverse proxy configurations.
Self-hosted email servers using Postfix, Dovecot, and SpamAssassin with ClamAV, implementing spam protection through DKIM, SPF, and OpenSRS.
Additional capabilities include shell scripting, firewall configurations with ipset and blacklists, VPN setup with OpenVPN and WireGuard, disaster recovery, backup strategies, and CDN/DNS services.
Fine-tuning and abliteration of open source language models, with hundreds of thousands of downloads on Hugging Face. Model quantisation and optimisation for consumer hardware, plus dataset preparation and curation.
Agentic AI systems and RAG pipelines, integration with LLM provider APIs, and prompt engineering and evaluation for predictable behaviour in production.
Experience with WordPress and Shopify, including custom theme design, modifications, and custom plugin development.
SEO optimisation so sites rank well in search engines.
A decade of production work for Australian businesses and the agencies that serve them. Most of these systems are still running, and still being looked after.
Architected and built a multi-tenant SaaS application from the ground up using Laravel and Vue.js. Designed the API layer, tenant isolation, subscription billing integration and role-based access control. The platform scaled to serve thousands of active users across multiple organisations.
Took over a large legacy PHP codebase for an established business and incrementally migrated it to a modern Laravel architecture. This included restructuring the database layer, building a RESTful API, implementing automated testing and deploying with zero downtime to keep the business running throughout the transition.
Developed a custom Laravel API backend for an e-commerce platform, integrating with third-party payment gateways, inventory management systems and shipping providers. Focused on security hardening, PCI compliance considerations and performance optimisation under high traffic loads.
Built internal tools and workflow automation systems for small and medium businesses. Everything from CRM-style platforms to booking systems to data dashboards. These projects typically involve close collaboration with non-technical stakeholders to translate business requirements into clean, maintainable software.
Designed and managed production server environments for multiple clients, including load-balanced configurations, automated deployment pipelines, firewall management, email server setup with full DKIM/SPF/DMARC compliance and ongoing monitoring. Security reviews and vulnerability assessments run across the same environments.
Independent research led to CVE-2026-110912, an unauthenticated kernel memory disclosure in DragonFly BSD. It is reachable from a single crafted ARP packet. Reported to the project, CVSS 7.1, fix merged upstream, with a working proof of concept and a write-up on this blog. Hack the Box and Hack Smarter walkthroughs cover the web application side of the same interest.
Set up automated build and deployment pipelines using GitHub Actions, GitLab CI and shell scripting. Configured staging and production environments with automated testing, zero-downtime deployments and rollback strategies. Just reliable pipelines that don't need babysitting.
Integrated LLM features into existing Laravel applications for clients, including AI-assisted content generation, intelligent search and automated data processing. Built RAG pipelines for domain-specific knowledge retrieval, and fine-tuned open source models for client use cases. My own open source models are on Hugging Face.
Built and customised Shopify stores for clients across retail, services and hospitality. This includes custom theme development, app integrations, payment and shipping configuration, SEO and performance tuning. Many of these projects involved taking an existing store and rebuilding it into something the client can actually manage themselves.
