adil@systems:~$ whoami
Adil Alperen Ciftci :: systems security engineer
runtime boundaries | workload identity | protocol invariants | upstream engineering
Systems Security Engineer working where kernels, identity, cryptographic protocols, and production control planes meet.
| Boundary | Architecture focus | Representative systems |
|---|---|---|
| Linux/eBPF and kernel sandboxing | cgroup-scoped execution evidence, datapath state machines, file-descriptor lifetime, capability reduction, Capsicum confinement | Cilium, Falco, Kata Containers, Linux, FreeBSD |
| Workload identity and cryptographic protocols | SPIFFE identities, X.509 path validation, RFC 5280 constraints, CA rotation, PKINIT trust boundaries | SPIRE, workload PKI, certificate toolchains |
| Windows AD/Kerberos identity boundaries | PAC semantics, delegated managed service accounts, graph-derived authorization edges, DNS name compression invariants | Impacket, BloodHound, SharpHound |
| WAF and protocol invariant verification | SecLang state, bounded parsers, checksum coverage, CoAP block transfer, TLS negotiation | Coraza, OWASP CRS, Scapy, libcoap, Nmap |
These links point to merged changes in the upstream repositories.
| Project | Merged engineering change |
|---|---|
| Cilium #49130 | Applied BackendTLSPolicy validation and transport settings to Gateway API GRPCRoute backends. |
| Falco libs #3112 | Preserved plugin field-extraction failures as observable runtime errors instead of losing the diagnostic boundary. |
| SPIFFE/SPIRE #7303 | Capped CA rotation and issued X.509 lifetimes against the verified upstream chain expiry. |
| Impacket #2304 | Bounded DNS compressed-name traversal when pointers form a cycle. |
| DefectDojo #15961 | Corrected Finding Group visibility for authorized product members, including empty groups. |
| Dependency-Track #7323 | Added optional HMAC-SHA256 authentication over the exact transmitted webhook bytes. |
| Aether #3423 | Enforced certificate path length and issuer-validity constraints. |
| Aether #3340 | Required basicConstraints.cA and keyCertSign during certificate path verification. |
| System | Invariant under review |
|---|---|
| Kata Containers #13933 | Preserve approved environment-variable bytes after validation. |
| Coraza #1770 | Enforce non-file request-body accounting across multipart and partial-processing paths. |
| OWASP CRS #4853 | Keep SQL token boundaries deterministic around MEMBER OF and JSON_EXTRACT. |
| Scapy #5191 | Include encapsulated payload padding in UDP checksum coverage. |
| Nmap #3584 | Offer SHA-384 signature schemes in the default NSE TLS negotiation set. |
| RT-Thread #11935 | Validate descriptor bounds and detach signal listeners safely during close. |
| libcoap #2208 | Preserve Block1 byte coverage when the block size exponent changes. |
| Aether #3441 / #3458 | Intersect independent sandbox policies and restore nested host map context. |
- Runtime Provenance Firewall: correlates cgroup-scoped eBPF evidence, artifact digests, SLSA provenance, and in-toto runtime statements; missing evidence blocks an allow decision.
- Enterprise Purple Range: isolated Windows identity, endpoint, and network evidence correlation lab.
- Adversary Validation Range: controlled validation actions against disposable targets with benign baselines and detection assertions.
- CPS Process-Integrity Harness: deterministic synthetic process-integrity experiments without physical-controller interaction.
issue state -> minimal reproducer -> BEFORE failure -> root cause
-> surgical patch -> AFTER pass -> related-package regression
Builds and runtime tests execute in isolated lab environments. Patch scope stays narrow, state-machine assumptions are made explicit, and every public result states what was verified and what remains platform-dependent.
Use the research portfolio for the consolidated engineering record and GitHub for project-specific correspondence. No OpenPGP public key is currently published on this account; do not trust a third-party key as mine without an independently verified fingerprint.