I'm a member of the .NET Foundation and I spend most of my time on open source, building .NET libraries, ASP.NET Core security tooling and browser extensions, and contributing to ASP.NET Core and the wider .NET ecosystem. Everything I make is free to use. If something here saved you some time, you can say thanks by sponsoring me on GitHub or buying me a coffee. I'm also saving up for a PhD, so every little bit really helps.
- AI Exporter: saves your ChatGPT, Claude, Gemini and other AI chats as PDF, Word, Markdown and more. 700+ users, rated 5/5. Chrome · Firefox · Edge
- PixelForge: MIT image processing for .NET with an ImageSharp-style API, no license key and safe defaults for user uploads. NuGet
- UploadGuard: secure file uploads for ASP.NET Core that catch zip bombs, macros, PDF JavaScript and disguised files. NuGet
- aspnetcore-security-bench: a benchmark and technical report on ASP.NET Core misconfigurations that CodeQL, Semgrep and the .NET analyzers all miss.
- ASP.NET Core: security work across authentication, Identity and passkeys.
- Passkeys (WebAuthn): COSE algorithm and curve validation when decoding a passkey public key, and a controlled sign-in failure instead of an unhandled exception when the passkey challenge has expired.
- Identity and two-factor authentication: two-factor authentication on external-login sign-in in the Identity UI, failed
/manage/2faupdates surfaced in the Identity API, clearer default emails for people who didn't ask for them, and a 500 error on malformed reset and confirmation codes. - Authentication: TLS channel binding kept when client certificates are forwarded, no cookie renewal after failed principal validation, and a depth limit for nested LDAP groups in Negotiate.
- Authorization: the routing guard for unprocessed authorization metadata, extended to
AuthorizationPolicyandIAuthorizationRequirementDataso a misconfigured pipeline fails fast instead of silently skipping authorization. - Antiforgery and rate limiting: antiforgery HTTP method limitations documented in the API reference and on Microsoft Learn, and rate limiter ordering. These are the findings behind the technical report above.
- Middleware and caching:
MapStaticAssetsconventions on the fallback endpoint andRedisOutputCacheStorereleasing the wrong connection on reconnect.
- Spectre.Console: escaping of interpolated arguments in markup and
Alignmeasuring with an explicit width. - Tiptap:
getReferencedVirtualElementforwarded to the plugin in the React drag handle. - Microsoft Q&A: I answer .NET and ASP.NET Core questions as a Q&A Champion.
Also ASP.NET Core, .NET MAUI, React Native, SQL Server, REST and OpenAPI, LLMs and RAG.
Website · NuGet · ORCID · GitHub Sponsors