$ whoami
Sang Tran
Application Security Engineer
I find the bugs before attackers do, and build the guardrails so they stay fixed.
Press ` to open the terminal.
this site, by the numbers
- 0third-party scripts
- 0cookies
- strictCSP, no inline JS
- RFC 9116security.txt
selected work
sangtran.dev: a strict-CSP static site
This site: a static Astro build under a strict Content Security Policy, with every security and quality rule enforced by an automated check.
AstroTypeScriptCloudflare WorkersVitestPlaywrightaxe-coreLighthouse CIGitHub ActionsCodeQL
CI security gate for this site
The checks that run on every change to this site: tests, accessibility, dependency audit, code scanning and secret scanning, with pinned actions and read-only permissions.
GitHub ActionsCodeQLgitleaksnpm auditCycloneDXDependabotOWASP ZAPDockeraxe-coreLighthouse CI
latest write-ups
A security gate for a personal site, built with an AI assistant
What runs on every change to this site, what it cannot enforce on a private repo, and what comes next. Vibe coded, so the checks are the proof.
Zero Day: a tiny first-person shooter, and how I tested it
How I built a ray-cast shooter that runs in a window on this site with no images, no audio files and no dependencies, and the bugs that tests found along the way.
Log Detective: a small game for learning to read logs
How I built a timed game where you find the one malicious line in a server log, how its cases are kept fictional and checked by tests, and the loophole I shipped and then found.