I’m a student at HAL Osaka, building production software by day and taking it apart by night.
Most of what I know came from shipping things that had to actually work — APIs that stay up, interfaces people can move through without thinking, and tooling that removes the boring parts of a workflow. I write across the stack because the interesting problems rarely respect the boundary between front and back.
The security side started as curiosity and turned into discipline. Working through authorized assessments taught me to read a system the way an attacker does: assume nothing, verify everything, and pay attention to the seams where two components agree to trust each other.
I’m mentored by a former Netflix Senior Cloud Engineer, which reset my sense of what “done” means. Reliability at scale, observability, blast-radius thinking — the habits that separate a project from a product.
NowAugust 2026 — Present
Co-founded Millelith in August 2026. As CTO I own the engineering direction, as security researcher I make sure what we build holds up against the people trying to break it, and as software engineer I still build hands-on.
Authorized.
Verified.
Reported.
Since August 2026, Millelith engagements have taken me through SMEs and household-name enterprises across Indonesia and Japan. The interesting parts stay confidential. The numbers don’t.
Authorized assessments for banks, a telecom operator, venture capital firms, technology startups, universities, government bodies, and hospitals, from SME to enterprise scale. Every finding reproduced, rated, and handed to the owner with remediation guidance.
More than a third scored 9.0 or higher under CVSS v3.1: the class of issue that ends in full compromise if left alone. Reported through coordinated channels under written authorization; the details stay with the owners.
An AWS IAM access key cached in the public frontend bundle of a venture capital firm. Reported privately; the key was rotated and the exposure closed.
FixedPublicly reachable database ports across venture capital, university, government, and hospital systems. Reported to each owner; access was restricted to internal networks.
FixedA JWT signing secret exposed by a fintech API provider, enough to forge valid session tokens. Reported privately; the secret was rotated.
FixedActive Azure AD application credentials shipped inside the public JavaScript of a national telecom operator. Reported privately; the credentials were revoked.
FixedA major Japanese technology and telecom group ran internet-facing software well past end-of-life, exposed to several publicly known CVEs. Reported privately with upgrade paths.
ReportedA global video game publisher shipped production services on end-of-life components carrying published CVEs. Reported privately with remediation guidance.
Reported01AI CV Scorer2025
Scores a résumé against a job description and explains the gap.
Matchingg reads a CV and a job posting, then returns a match score with the reasoning attached — which requirements are covered, which are missing, and what phrasing is costing the candidate points.
The hard part was making the output trustworthy rather than merely confident: structured extraction first, scoring second, so every number traces back to something actually present in the document.
TypeScript 
NestJS 
PostgreSQL 
LLM APIs 
Angular 
02CLI Tool2025
Removes the ritual from the commit-and-push loop.
A command-line tool for the repetitive half of version control — staging, conventional commit messages, branch hygiene, and push, collapsed into a single intentional command.
Written to be predictable above all: it never rewrites history you did not ask it to rewrite, and every destructive path requires confirmation.
Go 
Bash 
Git Plumbing 
03Editorial Web2024
A discography and archive built as a love letter.
A fan-built archive for RADWIMPS — releases, timelines, and lyric context, laid out with the kind of typographic care the music deserves.
Entirely front-end craft: responsive editorial layout, image performance discipline, and motion that supports the reading rather than interrupting it.
Angular TypeScript 
CSS 
GSAP 
04Security Platform2026
Recon, findings, and AI-written reports for authorized assessments. Private.
The internal platform behind Millelith engagements: a NestJS backend and scanner service on Node 20, an Angular 21 console with a dark terminal feel, and a shared TypeScript contracts library that keeps finding schemas, DTOs, and bus messages honest across services.
The recon engine is a Bash pipeline over nmap, ffuf, gobuster, subfinder, dnsx, dig, and whois, with Python helpers for parsing. Findings flow through RabbitMQ into MariaDB via TypeORM; Claude writes the report prose against Zod-validated schemas and Puppeteer renders the PDF. Everything ships as Docker Compose behind Tailscale, tested with node:test and GitHub Actions.
TypeScript NestJS Angular 
TypeORM 
MariaDB 
RabbitMQ 
Claude API 
Docker Bash Private repository — no public source or demo.
Burp Suite 
ZAP 
Nuclei 
OWASP Top 10 API Top 10 
SANS Top 25 
HackerOne Nmap ffuf Gobuster Subfinder dnsx dig whois jq 
Metasploit sqlmap Hydra John the Ripper 
Hashcat Nikto 
Wireshark 
Kali Linux TypeScript 
JavaScript Go 
Python 
Kotlin Bash 
PowerShell Angular 
React 
Three.js GSAP 
HTML CSS 
Node.js NestJS 
Fastify PostgreSQL MariaDB 
Redis TypeORM RabbitMQ 
JWT 
Puppeteer Claude API 
Zod Docker 
Tailscale 
GitHub Actions 
Vercel 
DigitalOcean Git Let’s build
or secure
something.
Open to security engagements under written authorization, partnerships, and problems that don’t fit neatly in either box. Osaka hours, worldwide reach.
