Goals

Where I am trying to get to

Written down and published, because a roadmap nobody can check is just a wish list. Completed goals stay on the page — the record is the point.

2026

Ship real things, and get through the door.

In progress

Learning paths, an open contribution format, and enough challenge coverage that someone can go from nothing to competent inside one domain.

In progress

Working end-to-end encryption, verifiable identities, and a written threat model published alongside it.

In progress

One properly written piece a month. Not solve logs — write-ups that explain the reasoning, including the paths that went nowhere.

In progress

Prepared through the labs, with a written report for every machine rather than a screenshot folder.

In progress

In application security, starting September 2026. This is the one everything else is pointed at.

Go deeper, and give something back.

Planned

White-box web exploitation. Reading source and turning it into working exploits is the skill I want to be measured on.

Planned

Application security full time — reviewing designs, breaking implementations, and building the parts that need to hold.

Planned

Consistent scope-respecting research with reports good enough that triage is boring. Quality over volume.

Planned

Security tooling I already use. Fixing my own annoyances is the most reliable contribution pipeline there is.

Planned

Present research — even a short talk at a local event. Writing it up for an audience is the fastest way to find the gaps in your own understanding.

For the shorter horizon, /now covers this month.