$ whoami
Sang Tran
Application Security Engineer
I find the bugs before attackers do, and build the guardrails so they stay fixed.
Press ` to open the terminal.
this site, by the numbers
- 0third-party scripts
- 0cookies
- strictCSP, no inline JS
- RFC 9116security.txt
selected work
latest write-ups
Zero Day: a tiny first-person shooter, and how I tested it
How I built a ray-cast shooter that runs in a window on this site with no images, no audio files and no dependencies, and the bugs that tests found along the way.
Log Detective: a small game for learning to read logs
How I built a timed game where you find the one malicious line in a server log, how its cases are kept fictional and checked by tests, and the loophole I shipped and then found.
A strict-CSP personal site, and the bugs its checks caught
How this static Astro site enforces a strict Content Security Policy with tests, and the real bugs that axe, Lighthouse and end-to-end tests found along the way.