Software developer
One deliberate body of work, held to a single standard: software you can verify, run fully offline, and trust not to phone home. Every project ships with public source and a static trust report, so a clean no-telemetry posture is something you can inspect before you run it — not a claim you take on faith. Built in the open as a standing practice in AI pair-programming.
github.com/ariugwuM.S. in Cyber Security. Full-stack background spanning TypeScript, .NET, SQL Server, and Elastic Search. I gravitate toward security and reliability problems — and toward turning them into things you can read, run locally, and audit yourself.
One body of work in three parts — the apps you run, the libraries they're built from, and the passion projects I tinker with. The trust report each one ships is concrete, not a slogan: an SBOM, a full license inventory, and a documented offline posture, versioned in plain files in the public repo.
Three plain promises, the same for every project — and each one you can check for yourself:
Verifiable. The source is public, and every project ships a trust report: a parts list of everything inside it (an SBOM), a full inventory of the licenses, and a note on how it behaves with the network off. You don't have to take my word for any of it — the receipts are right in the repo.
Offline. These run on your own device, in your own browser. Switch the network off and they keep working; your files and notes never have to leave the machine.
No telemetry. Nothing phones home — no tracking, no analytics, no accounts, no quiet uploads. There's simply nowhere for your data to leak to.
The reusable cores — published to npm, NuGet, and the VS Code Marketplace. Most are one Rust core compiled to native + WebAssembly and wrapped across several surfaces.
A pocket toolkit for the people who actually wrangle PKI files. Drop in a mystery X.509 cert in some odd encoding, a PKCS#12 bundle, a CHUID container, a portrait JPEG, or a fingerprint WSQ — pivlib will tell you what it is, classify the PIV key role from the evidence, and hand you a canonical form. One Rust → WASM core, five surfaces.
A local-first notebook engine that turns typed pages into a personal
knowledge graph. Each page kind — math word problems,
philosophy papers, recipes, logic, history — is its own
@stultus/page-* npm package plugged into
@stultus/notebook, which stores everything in WASM SQLite
and links pages into queryable nodes and relationships. One library
family, many page kinds, entirely in the browser.
A browser Endpoint Detection & Response extension — it matches browser events to MITRE ATT&CK signatures and responds, catching what a host agent can't see from outside the browser: rogue extensions, OAuth consent phishing, lookalike logins. The shipped extension is deliberately small and auditable — zero runtime dependencies, a least-privilege manifest, no telemetry — and in practice just ships detection data to your SIEM.
Just some things I always wanted to make.
A space-courier roguelite with a CRT phosphor aesthetic. Persistent Past Lives carry upgrades and dialog memory across loops. Pure TypeScript engine; Vite + React on the web, Tauri for desktop and Steam.
A portal for four spoken-word and music projects in progress — an open-mic poetry zine, a weekly public-domain audiobook, an album of short hymns, and a zine + podcast chronicling Black history event by event, each told as a story of horror, of endurance, of hope. All proceeds route to Hawks Land Trust.