← Joshua Bullock

Qualifications

Security professional who also builds and ships software.

Security

Bug bounty
Finding and responsibly disclosing vulnerabilities in production web applications and APIs.
Red teaming
Adversary-minded testing of applications, infrastructure and people-facing processes.
Information assurance
Protecting the confidentiality, integrity and availability of sensitive data, with controls and audit trails that hold up to review.

Engineering stack

Languages
Python, TypeScript, JavaScript, SQL, HTML/CSS, Bash, PowerShell
Front end
React / Next.js, vanilla JS, responsive and mobile-first UI
Back end
FastAPI, Cloudflare Workers, REST APIs, scheduled jobs
Data & cloud
Cloudflare D1, R2, Queues, KV, Workers AI, Turnstile, Access
AI
Local LLMs with Ollama, multi-agent orchestration, tool use with human approval
Security controls
Human-in-the-loop approval gates, least-privilege permissions, audit logging, server-side secret custody, tenant and infrastructure isolation
Shipping
GitHub Actions CI, Windows and Linux installers, auto-update, pytest, custom audit tooling

Selected builds

SoggyWaffle

Desktop app · Python, FastAPI, Next.js, Ollama, Playwright · v1.0.30

A crew of AI agents that runs entirely on your own computer using local Ollama models. A "chief of staff" bot takes each request and hands parts to other bots, which browse the web, research, handle email and files, and run scheduled tasks.

  • Action gateway: anything risky (sending, submitting, clicking, running commands) waits for the user's approval and is written to an audit trail.
  • Per-bot and per-group permissions for browser, files, email, terminal and crew access.
  • Live view of each bot's screen and reasoning; the bot hands the browser to the user for captchas and logins.
  • One-click Windows and Linux installers built on GitHub Actions, with automatic in-app updates.
  • 96 backend tests in pytest.

Download

Lodestone Data

API platform · TypeScript, Cloudflare Workers, D1, R2, Queues, Workers AI · in development

A data API and marketing site for an NWISI company, built to keep provider credentials server-side and keep a full compliance record of every search.

  • Serverless API on Cloudflare Workers: auth, billing, batch processing, admin, and a grounded AI assistant.
  • D1 (SQLite) as the audit ledger, R2 for batch files and reports, Queues for per-row batch jobs with retries.
  • Infrastructure kept fully separate from the licensed agency: own repo, account, domain and data store.
  • 12-page static site from a dependency-free Python build, gated by a 1,090-check audit and a headless-browser pass.

This site

Static site · HTML, CSS, Cloudflare Workers

Hand-written HTML and CSS with automatic light and dark themes and security headers, deployed from GitHub to Cloudflare on every push.

Get in touch