Hi, my name is Will

Security engineer building software supply chain and DevSecOps tooling.

Six years in federal cybersecurity. I build tools that turn scan results into evidence: where a vulnerability came from, which control it affects, and who can fix it.

I keep a lab notebook called Ramblings where I share ideas, experiments, and security write-ups.

Projects I'm proud of

Software Supply Chain · Featured

What's In My Image (wimi)

Teams often blame the base image for CVEs without evidence. wimi replaces that assumption with proof: it unpacks a container image layer by layer and traces every package and CVE to the base image or the build step that added it, matching base layers by SHA-256 digest. The output is a self-contained HTML report a CISO can read in two minutes and an engineer can act on, plus JSON and CSV.

Highlights:

  • Zero dependencies — runs air-gapped
  • Trivy / Grype / Harbor import
  • Signed releases with SLSA provenance & SBOMs
  • OpenSSF Scorecard
  • CI & tests

Sample report Docs View on GitHub

Cloud Security & GRC

cloudcomply

A Go TUI that scores AWS Organizations against NIST 800-53 control families and DoD SRG impact levels (live Security Hub integration in progress). Findings can be filtered to the DoD Cloud Computing SRG impact level a Mission Owner is targeting (IL2/IL4/IL5/IL6), so they see a score for the controls actually in scope rather than the full catalog. Ships as a single static binary that drops straight into AWS CloudShell. Runs today on realistic demo data.

Technologies used include:

  • Go
  • Bubble Tea — TUI framework
  • Bubbles — table, spinner components
  • Lip Gloss — terminal styling

View on GitHub

Network Security

gopher-scan

A concurrent TCP port scanner written in Go. A goroutine worker pool scans thousands of ports in seconds, and it accepts hostnames, IPv4/IPv6 addresses, and CIDR blocks, so a whole subnet takes a single command. Open ports are mapped to well-known service names, and thread count and connection timeout are tunable.

Technologies used include:

  • Go
  • Goroutines & worker pools
  • TCP networking
  • Cobra — CLI structure

View on GitHub

Other tools

Talks & Writing

Contact me

I’m interested in conversations about software supply chain security, DevSecOps tooling, and building security into products.

Email me