Security Engineer | CISA | OWASP Contributor | Crest Hill, Illinois
LinkedIn | Email | PhishGuard AI on GitHub Marketplace
My public work focuses on practical security automation: tools that make risk easier to detect, explain, reproduce, and act on.
Current evidence signals:
- Built and published PhishGuard AI, a reusable GitHub Marketplace Action for explainable offline phishing detection.
- Contributed merged work to recognized security projects including OWASP, OWASP cve-lite-cli, Prowler, and SecOps-NG Framework.
- Maintain public engineering records with tests, release notes, security boundaries, and dated contribution evidence.
- Hold the CISA and CompTIA Security+ certifications, with a BS in Information Technology from Arizona State University.
See the full evidence record:
Repository | Marketplace Action
I built PhishGuard AI, an explainable offline phishing detection engine for URLs and email, published as a reusable GitHub Action.
PhishGuard AI runs with zero runtime dependencies, outputs JSON and SARIF 2.1.0, and integrates with GitHub Code Scanning. It treats email authentication signals such as SPF, DKIM, and DMARC as supporting evidence rather than binary proof, including regression coverage for legitimate forwarding failures.
Key capabilities:
- URL, email, redirect, typosquatting, and authentication-signal analysis
- Conservative SPF, DKIM, and DMARC scoring from trusted receiver headers
- SARIF output for GitHub Code Scanning integration
- Public benchmark fixtures and documented model limitations
- Good-first issues and contribution documentation for new contributors
Try it in a workflow:
- uses: omobolajiadeyan/phishguard-ai@v0.5.1Explainable offline phishing detection for URLs and email. Zero runtime dependencies, SARIF 2.1.0 output, GitHub Code Scanning integration, benchmark fixtures, and documented model limitations.
Secure cross-platform checkers with minimax AI, real-time multiplayer, SQLite ratings, WebSocket notifications, and PWA support. Security work includes hashed session tokens, explicit session revocation, active-match logout protection, bounded WebSocket payloads, strict CORS, and multiplayer regression tests.
Private pre-launch project for converting application-security scan findings into traceable draft NIST SP 800-53 control mappings and POA&M evidence. The project is currently private while parser security, architecture, licensing, and delivery plans are finalized.
Behavioral anomaly detection engine for user and IP risk scoring, including UEBA patterns for insider-threat detection and MITRE ATT&CK-style mapping.
Selected merged work and active reviewed PRs:
- OWASP Agent Security Regression Harness: PR #150 merged recursive scenario validation for directories and globs with green CI.
- Prowler: PR #11098 includes Microsoft Entra directory-sync object-takeover work credited as co-author.
- OWASP cve-lite-cli: PR #602 merged risk and next-action guidance for HTML vulnerability reports.
- SecOps-NG Framework: PR #281 merged CRA Article 13(8) support-period mapping with cited sources.
- Dependency-Track: PR #6477 proposes a runtime-backed OpenAPI Finding response schema. Maintainer feedback has been addressed; DCO, Codacy, and Snyk checks pass.
- RamenDR ramenctl: PR #466 pins GitHub Actions to commit SHAs, disables persisted checkout credentials, and documents tag-to-SHA verification for supply-chain hardening.
- OpenSSF Scorecard: PR #5098 proposes extending Dangerous Workflow detection to committer-controlled GitHub Actions contexts.
- CISA ScubaGear: PR #2237 proposes a DMARC policy discovery tree-walk fix for Microsoft 365 baseline assessment logic.
For the full dated record, see OPEN_SOURCE_LOG.md.
- From Single Files to Scenario Suites: Batch Validation in the OWASP Agent Security Regression Harness
- SPF, DKIM, and DMARC in Phishing Detection: Useful Signals, Not Magic Answers
Python | JavaScript | TypeScript | Node.js | React | FastAPI | PHP | SQLite | PostgreSQL | Docker | GitHub Actions | SARIF | CodeQL | MITRE ATT&CK | NIST SP 800-53 | vulnerability management | cloud security tooling
I am open to senior security engineering roles, application-security tooling collaboration, technical advisory conversations, and community work around practical security automation.