English · Français

Based in Switzerland.

celo-credentials-dapp is a full-stack reference application for gasless, non-transferable education credentials on Celo. Institutions sign EIP-712 vouchers off-chain, a relayer pays the gas, and credentials remain publicly verifiable and revocable on-chain.

• On-chain: fully source-verified contract on Celo Sepolia, with public issuer authorization, issuance, active verification, and revocation evidence
• Application: Solidity, Foundry, Express, PostgreSQL, Next.js, wagmi, viem, and TypeScript
• Security design: authorized issuers, replay and expiry protection, non-transferability, revocation by the contract owner or the still-authorized original issuer, and 11/11 Foundry tests including fuzzing

Public testnet reference implementation with a reproducible credential lifecycle; not independently audited for production use.

Security research on web applications, smart contracts, and AI systems. Published findings include reproducible evidence and a documented impact.

Focus

• Web and application security: web applications, APIs, access control, business logic, and integrations
• Smart contracts: Solidity / Vyper, Foundry fork PoCs, formal verification
• ZK & applied cryptography: circuits, verifiers, proof systems
• AI and agent security: indirect prompt injection, tool misuse, agentic attack paths, and adversarial evaluation

Proof of work

• security-reviews, a catalogue of reproducible reviews, one repo per vulnerability class. Each ships a vulnerable target, an exploit PoC, a remediated branch, and a report, all green under CI.
• erc4626-inflation-audit. ERC-4626 first-deposit share inflation.
• eip712-signature-replay-audit. ECDSA signature malleability double-spend.
• reward-accounting-drift-audit. MasterChef-style reward accounting drift.
• stvault-audit. Lending vault: oracle staleness, cross-function reentrancy, fee rounding.
• vyper-access-control-audit. Vyper vault: unguarded ownership transfer (access control).
• circom-underconstrained-audit. ZK: under-constrained Circom circuit, Groth16 soundness break.
• formal-verification-overflow-audit. Formal verification: averaging overflow refuted then proved with Halmos.

Professional security profiles

• Gray Swan Arena: GilMu (indirect prompt injection research and adversarial AI evaluation)
• HackerOne: @gilmu (Treasury Board of Canada Secretariat)
• Cantina: @GilMu (Reserve Protocol and Revert Finance)
• Code4rena: @GiMu84 (Chainlink Payment Abstraction V2 and K2)

Python services and infrastructure work focused on asynchronous execution, fault handling, and observability.

• production-agent-template. FastAPI agent service template: async lifespan, health and dashboard endpoints, circuit breaker registry, application-defined recovery hooks, Prometheus metrics, optional background loop, and scaffolding.
• agent-resilience. Circuit breaker, Redis-backed DLQ, offline MQTT buffer.
• async-api-client. Resilient async REST client: rate limiting, retries, pagination.
• agent-self-healing. Dependency health monitor with online/degraded/error states and auto-recovery.
• agent-metrics. Dependency-free counters, gauges, histograms with Prometheus text exposition.
• infra-reference. Sanitised platform-engineering reference: multi-arch Ansible, hardened systemd, distroless builds, mesh and observability.

Engagement: backend APIs, integrations, observability, CI.

Applied AI architecture, multi-agent systems, local-model orchestration, and automated build and review pipelines.

• AI Adoption Playbook. Interactive guide for choosing between AI assistance, workflow automation, decision support, and autonomous business agents. It covers realistic use cases, pilot design, evidence, controls, and Swiss and EU governance requirements. Open the guide.
• talos. Distributed agentic platform: ~55 agents and 85+ services across a four-node fleet, four-part memory, real-time voice and chat assistant, and automated build pipelines.
• multi-agent-orchestrator. Capability-based task routing template.

Stack: Python (async-first) · local LLM ops (llama.cpp / GGUF, model routing, VRAM-aware hot-swap) · multi-agent orchestration · graph-RAG memory · vector search · MQTT event bus · real-time voice · Prometheus / VictoriaMetrics · systemd · CI (ruff, pytest, pre-commit).

I document claims with reproducible examples, measure changes when useful, and verify behavior by running the system.

• Inaricom case study: hybrid WordPress/WooCommerce backend and React interface rebuild in progress (project URL).
• Mika's Shop case study: end-to-end Shopify store design and implementation (live store).
• Pedi-Sense case study: end-to-end Shopify store design and implementation (live store).