Muhammad Ablugg
Security Engineer
CompTIA Security+
massrealtyinc.ca · live
Security Engineer
Built to withstand attack.
Verified by design.
I'm a security engineer who builds systems where trust is eliminated, not assumed. My deepest work is in local-first AI · architectures where the model runs entirely on the user's device so client data never leaves the machine. No cloud endpoint to breach, no vendor with access to plaintext, no network hop to intercept. I also build the security tooling around these systems: attestation verification, PCR drift diagnostics, supply chain integrity gates, and prompt injection fuzzers.
I also build production software, and that is where my security engineering gets tested for real. I designed and shipped massrealtyinc.ca for a registered Ontario brokerage · a live platform where passwords are scrypt-hashed with timing-safe comparison, sessions use HttpOnly/Secure/SameSite cookies, every endpoint is rate-limited through Upstash Redis sliding windows, image uploads are validated by magic byte signatures, and OData queries are escaped against injection. When my own compliance audit found a feature using IDX data in a way the PropTx agreement prohibited, I removed it. Security engineering means saying no to your own feature when the contract demands it. I was re-engaged in April 2026 to build the company's second site from scratch.
My tooling work spans AI/ML security (prompt injection fuzzing across 8 attack categories), network analysis (protocol-level packet dissection), applied cryptography, and supply chain verification with SLSA provenance and Cosign. CompTIA Security+ certified, CISSP in progress.
Sec+
CompTIA Security+ certified · CISSP in progress
7+
Security tools and hardened platforms shipped
Live
massrealtyinc.ca · production platform I secured end to end
Currently
buildingsecurity tooling · attestation verification · supply chain gates
studyingCISSP domains · cloud security architecture
focusconfidential computing · AI/ML security · secure-by-default systems
Shipped Work
What I've built and secured.
Confidential Computing · Core Systems
LOCAL AI · ZERO TRUST · FLAGSHIP
Mizan · Confidential Legal AI
Every legal AI platform decrypts your data on a server they control. Mizan eliminates that attack surface entirely: the AI model runs locally on the lawyer's machine. Documents, queries, and client matters never leave the device. Zero bytes sent. The most comprehensive Canadian legal knowledge base of any offline-capable legal AI, with coverage across federal and provincial legislation. No cloud endpoint to compromise, no network hop to intercept, no server-side decryption window. Explore the interactive threat model to see how the architecture holds up.
AZURE TEE · E2E ENCRYPTED AI
Lexora · E2E Encrypted AI Platform
Built the full encrypted pipeline between user and AI on Azure Confidential Computing. Messages are encrypted client-side using WebCrypto AES-256-GCM with PBKDF2-derived keys stored in IndexedDB · ciphertext travels to the server, is decrypted inside the Azure TEE boundary, processed by the AI, and re-encrypted before leaving the enclave. Plaintext never exists outside the TEE. MongoDB stores only ciphertext · no plaintext is ever written to the database. Azure attestation endpoint integration confirms enclave integrity before any key material is used. Rate limiting, DDoS protection, and session isolation across the full stack.
OPEN-SOURCE · ENCRYPTED LOCAL AI
Wazier · Zero-Trust Local AI
An open-source AI desktop app that runs entirely on-device with no cloud, no telemetry, and no data harvested. Every conversation is encrypted at rest with AES-256-GCM and stored in a local vault. Two separate encrypted stores: a 7-day auto-expiring chat vault and a permanent document vault with local RAG via nomic-embed-text embeddings. Zero bytes leave the machine after setup. If you won't trust a privacy claim without proof, clone it and run it airgapped.
Security Research & Tooling
AWS NITRO ENCLAVES · SECURITY TOOLING
Nitro Attestation Verifier
Client-side CLI tool and Python library for cryptographically verifying AWS Nitro Enclave attestation documents. Parses COSE_Sign1 and CBOR attestation structures, validates PCR0/1/2 against pinned baseline values, and inspects the X.509 certificate chain back to the AWS Nitro root CA. Three verification modes: descriptive inspection, pin-check against known-good baselines, and JSON output for CI/CD pipeline integration.
NETWORK ANALYSIS · PYTHON
Scapy Packet Sniffer
Local packet capture tool that performs layer-by-layer dissection from Ethernet through IP to TCP/UDP/ICMP. Detects and parses HTTP, DNS, SMTP, and FTP traffic in real time · outputs hex and ASCII payload representations with configurable per-protocol filters.
APPLIED CRYPTOGRAPHY · PYTHON
Consent-Gated Keystroke Auditor
Local keystroke audit tool built for security research. Requires explicit consent before capture begins · logs keystrokes encrypted at rest using Fernet (AES-128-CBC) with the key file stored at
chmod 600. Includes a separate decryption utility for log review. Designed to demonstrate the architectural difference between a malicious keylogger and a consented audit tool.
AWS NITRO ENCLAVES · SUPPLY CHAIN
PCR Baseline Diff
Diagnostic tool for Nitro Enclave attestation drift. When a KMS key policy starts rejecting decryption requests because PCR values changed unexpectedly, this tool diffs two EIF files, walks the binary section table, and attributes the drift to a specific build input · down to the exact Dockerfile layer. What would otherwise require manual bisecting collapses into one command. CI gate via exit codes: 0 for clean, 1 for identified drift, 2 for unattributed drift.
SUPPLY CHAIN SECURITY · CI/CD
Build Provenance Verifier
Deploy time gate for container supply chain integrity. Verifies that an image is signed by an allowed identity, carries a SLSA provenance attestation, was built by an allowed builder, and originates from an allowed source repository. Designed to run as a CI step before deploy or wired into a Kubernetes admission controller. The third leg of the supply chain story behind Mizan and Lexora · alongside the attestation verifier and PCR baseline diff.
AI/ML SECURITY · PYTHON
Prompt Injection Fuzzer
Black box fuzzer for LLM endpoints. Sends a corpus of prompt injection payloads across 8 attack categories · direct override, role confusion, encoding smuggling, indirect injection, tool abuse, prompt leak, jailbreak, and gradual escalation · scores each response for compromise indicators, and produces a CI compatible pass/fail report. Supports custom corpora and works against both Anthropic and OpenAI format endpoints. Built to catch system prompt regressions before they ship.
Production Systems · Security in Practice
CLIENT PLATFORM · LIVE IN PRODUCTION
MassRealty Inc. · Secured Production Platform
The complete web platform I designed and built for a registered Ontario brokerage, live and in daily use. Security is in the plumbing: passwords hashed with scrypt (random salt, 64-byte derived key) and verified with timing-safe comparison to prevent timing attacks. JWT sessions use HttpOnly, Secure, SameSite=Lax cookies. Agent and admin auth use HMAC-SHA256 signed tokens with timingSafeEqual. Per-endpoint rate limiting via Upstash Redis sliding window (login: 10/min, signup: 5/min, contact: 3/min, search: 30/min). Image uploads validated by magic byte signatures, not client-supplied MIME types. OData queries escape single quotes to prevent injection. Cloudflare Turnstile CAPTCHA on signup blocks bot account creation. Cron endpoints gated by CRON_SECRET bearer tokens. HTML output escapes &, ", ', <, > to prevent XSS. All API keys in environment variables, all external calls timeout at 2.5 seconds. Audited the platform against the PropTx IDX Data Agreement and removed an AI chat feature prohibited under Section 6.2(k). Re-engaged in April 2026 to build the company's second site.
LEGAL TECH · DATABASE SECURITY
CounselConnect
AI-powered legal marketplace co-founded and incubated at the Legal Innovation Zone at Toronto Metropolitan University. Managed MongoDB databases including security updates, data integrity testing, and disaster recovery protocols. Led product from ideation through production over 5 years, coordinating technical roadmap and sprint deliverables alongside the engineering co-founder.
Technical Writing
Writing it down.
The Nitro Enclave Gotcha That Cost Me 90 Minutes: vsock and a Port That Lied
A deep debugging session from building Mizan. The parent EC2 instance connected to the enclave over vsock without error · but nothing was actually listening. This is the story of how "connected" and "live" are two different things at the transport layer, and the health check pattern that fixes it.
Read on Dev.to
Capability Matrix
Tools of the trade.
Security Engineering
Application Securityproduction
Auth · JWT & Access Scopingproduction
Confidential Computing · TEEsproduction
Threat Modellingsolid
Cryptographic Attestationsolid
AI/ML Securitysolid
Supply Chain Integritysolid
AWS · Azure Securitysolid
Network Analysis · Wiresharksolid
Kali Linux · nmapworking
Development & Infrastructure
Pythonproduction
JavaScript · ES Modulesproduction
Node.js · Serverlessproduction
Linux · Bashproduction
Gitproduction
AWS · Vercel · Cloudproduction
Reactsolid
PostgreSQL · MongoDBsolid
REST · OData APIssolid
Docker · CI/CDsolid
Background
Education & training.
Cybersecurity Bootcamp
Springboard · Sept 2025 – March 2026
Bachelor of Arts, Psychology
McMaster University · Sept 2017 – June 2022
CompTIA Security+
March 2026 CISSP · In Progress
I took an unusual route here: a psychology degree, then a cybersecurity bootcamp and Security+, then building confidential computing platforms and security tooling that ships. That path built an engineer who thinks about the user, the system, and the attacker at the same time. Certifications tell you part of the story. The better evidence is the tooling, the threat models, and the production platform I secured end to end.
Establish Contact
Let's talk.
Open to Security Engineer roles.
I build confidential computing platforms, security tooling, and production systems hardened from the first commit. Threat modelling, attestation verification, supply chain integrity, AI/ML security, and the application security that keeps real platforms safe in production. If you need an engineer who thinks like an attacker and builds like a developer, I want to talk.
Get In Touch
One More Thing
Wanna play a game?
are you technical?