Fifteen years securing other people's systems. Nine months shipping my own.

Turns an insurance quote PDF into a ready-to-sign bind package — the AI reads the fields, a human verifies every one, then it routes to the underwriter. A live pilot.

CARRIED FORWARDEvery third-party wrapper now returns an explicit status the caller has to branch on, never a bare boolean. Recurring defects earn an automated gate, not a third paragraph of documentation. And every sensitive database function is denied by default and tested against all three Postgres roles, not just the one that bit me.

Tariff-refund recovery for small importers. Protest windows close on a fixed legal schedule and the refund pool shrinks 8–10% a month, so the whole product races the clock. Free analysis; broker partnership in progress.

CARRIED FORWARDStackBadger was born here, as the internal pentest harness. So did three habits that moved into everything after: the PII-scrubbing patterns, the Clerk-to-RLS auth fix, and a decision-hygiene routine — a versioned strategy doc with an open-decisions table, plus dated audits that diffed the live site against it.

A pentest harness for AI-built apps, extracted from a production SaaS codebase, then scrubbed and open-sourced. It was the only code still earning commits after the product work stopped.

CARRIED FORWARDThe extract → scrub → review release playbook: archive tracked files only, scrub every brand reference, decode anything credential-shaped to prove it's synthetic, then a human pushes. It's now the standard path for anything leaving a private repo.

Pre-MLS lead scoring for San Diego real-estate wholesalers: distress signals from 11 sources, scored so an operator can see why a lead ranks where it does. A fair-housing review cut a whole signal class before any code shipped. Full MVP in 7 days, then paused unlaunched.

CARRIED FORWARDCompliance shaping scope at design time: a fair-housing review removed an entire signal class before any code existed. And the checkpoint-and-circuit-breaker pattern for fragile, county-scale scrapers.

Built in 5 days to help a friend being stalked: a local-only pipeline that tracks the stalker's online activity to evidence standards — provenance on every finding, fail-closed defaults that never tip off the subject, attribution scoring with negative controls. Report delivered to law enforcement. Deliberately unpublished.

CARRIED FORWARDThe audit-the-design-before-building gate, and the fail-closed posture that refuses rather than warns. The repository itself stays private, permanently: it holds a real case.

Cyber-insurance readiness for small businesses, built to launch-ready and then paused on purpose. It's the project that taught me to audit my own guardrails: of 16 I'd built, exactly one provably worked.

CARRIED FORWARDThe guardrail rubric, the solution library, and the worktree protocol. And the successor product wrote its launch gates in advance precisely because this one validated late.

3D-printable replacement parts from a photo of the broken one. The adversarial PRD review asked whether photo-to-printable-geometry had actually been proven feasible. It hadn't. Scrapped at review, for the price of one session.

CARRIED FORWARDAdversarial review as a standing gate before any build.

Attack-surface intelligence for M&A due diligence: size up a target's external security posture before the deal closes. The PRD cleared adversarial review, then lost the build slot to TariffRefunded. A complete plan is a cheap thing to hold open.

CARRIED FORWARDThe Idea → Build framework itself, which every later project's PRD ran through.

My first product: a baseline security-risk assessment for small businesses, built on the CIS IG1 controls. Started off GitHub in late January; folded into its successor.

CARRIED FORWARDEverything: the successor is literally the same repository continued. Six agent skills and three reviewer agents survived into a roster that grew to 42 and 11, and the honest verdict (“nobody pays for an AI-interview risk assessment”) re-aimed the product at a question businesses do pay for.

Interview prep run as an agent workspace, not an app: a citation-enforced knowledge base, ten interviewer personas built from public record, and a mock mode that argues back in their voices. No database, no server: just a directory layout and 12 agent skills.

CARRIED FORWARDA general blueprint for becoming rapidly, defensibly conversant in any organization and its people: reusable for due diligence, sales prep, or expert-witness work.