Year 12 student, Cadet Under Officer, and future security engineer. Running a heavy STEM course load and commanding a company of 100+ cadets — headed for UNSW cyber security.
Dream degree: the double at UNSW — Bachelor of Information Systems / Bachelor of Computer Science — attacking security from both the business and engineering sides.
Governance, risk and the human side of security — protecting organisations, not just machines.
The technical depth — secure systems design, attack and defence, taught with an engineering mindset.
Software Engineering and Enterprise Computing cover the build side; Extension 1 maths covers the logic and number theory behind encryption; cadet command covers leading people under pressure. The double degree ties it all together.
Areas currently on the radar:
Critical analysis, argument construction and clear written communication — the social engineering of ideas.
Calculus, functions and statistical analysis. The core logic layer everything else compiles against.
Proof, combinatorics, vectors and harder calculus — the mathematics that underpins modern cryptography.
Mechanics, electromagnetism and the nature of light. First-principles thinking about how systems actually behave.
Programming fundamentals, secure development practices and the mechatronics of building real software.
Data systems, networks and how organisations run on information — and what happens when that breaks.
As a Cadet Under Officer with the Australian Army Cadets, I hold the appointment of Company Commander at HAHSACU — responsible for the leadership, training and welfare of the company on parade nights and in the field. Six years of service, holding every rank on the way up: Section Commander of ~10 cadets, Platoon Sergeant to a 50-recruit intake, Company Sergeant Major, and now Company Commander.
Straight into COVID lockdowns: field activities cancelled, a missed email that cost a whole term of parades, and an attendance warning from the OC that nearly ended it. Choosing to stay turned out to be the most important decision of the six years since.
Week-long state-wide Annual Field Exercises, 2–3 day bivouacs, WTSS weapons-simulation training, and promotion courses as both candidate and instructor — plus ANZAC and Remembrance Day services: dawn services, guards of honour and catafalque parties.
One of the school's oldest and largest programs. Training is planned and delivered by the NCOs — Lance Corporal through CUO — every Thursday from 1505 to 1800, built on the Army's values: Service, Courage, Respect, Integrity and Excellence.
Off the keyboard and out of uniform: white crane kung fu with Pak Hok Pai Australia. Empty-hand forms, weapons training with the dao — the single sabre — and performing lion dance with the school. Six years of the same lesson security keeps teaching: drill the fundamentals until they're reflex.
Point a camera at a vehicle part under the car, get instant identification with audio feedback, and request stock without ever leaving the job — designed end to end from a real client interview through to a working prototype, a relational database, and the network it runs on.
A dealership workshop's mechanics identify and request vehicle parts from stock takers by hand. The client — a mechanic — wanted camera-based part ID with audio feedback and in-app requesting, aimed at experienced mechanics specifically, so newer staff still learn to identify parts rather than lean on the app.
After a draft review, login moved from username/password to SMS verification, and the target audience narrowed from all mechanics to experienced ones only — WAILA is explicitly a support tool, not a replacement for skill.
A high-fidelity prototype, not a working system — no real backend, no persistence between sessions, no trained model behind the "AI." The folio is upfront about this: it exists to show the client what a final product could be. The most interesting risk it raises: handing an ID aid to newer staff risks quietly substituting for the workshop expertise it was only ever meant to support.
Register, fill in only the contact details you choose to share, and get a public page anyone can reach by tapping an NFC card against their phone. A vanilla-JS single page application talking straight to a Supabase backend — no framework, no build step, no server-side code of my own.
Paper business cards are wasteful, expensive to print in bulk, and hard-limited in what they can say by the size of the card — but the networking moment they exist for hasn't gone anywhere. Digital U keeps the tap-and-exchange and moves the card online: one NFC card stays with its owner permanently and hands over a URL instead of a hundred printed cards, with a QR fallback for phones without NFC.
The whole point of the site is showing one user's typed text to another, which makes stored XSS the headline threat — every value written into the page as HTML is escaped first, and the profile title is set as text rather than markup, so it cannot execute at all. No hand-written SQL exists; queries go through Supabase's parameterised builder. Passwords never touch my code, and the row owner is always read from the authenticated session, never from the form, so a save can't be aimed at someone else's profile.
Email verification and MFA are both off — Supabase's free tier caps built-in email at two per hour, which blocked sign-up testing outright. The API key sits in client code, safe only because Row Level Security is what actually enforces access. The build wasn't a straight line either: a week went into trialling Next.js before reverting to Flask, and Flask itself was later dropped entirely for a client-side SPA once Frozen-Flask proved to need a rebuild on every change.
Command-line arithmetic quiz game — a lives/streak system, a boss fight with harder expressions, a one-time calculator power-up earned by a 5-streak, and scores persisted to a stats file between runs.
View source ↗A four-department LAN built and secured in Cisco Packet Tracer — WPA2, port security, MAC locking — paired with a full threat analysis, 5×5 risk matrix and mitigation plan covering technical, human and organisational risk.
High-fidelity website prototype built in Adobe XD for a fictional driving school — wireframed and click-tested end to end, with an accessibility/privacy analysis and a full testing & evaluation pass against the original design brief.
Two micro:bits over radio: a remote sends enter/leave commands, the garage unit drives a servo door and neopixel lights, and an ultrasonic sensor beeps the car to a stop. Manual mode via a rotary-sensor knob as a fallback.
Written analysis of the Optus breach — an unauthenticated public API and an IDOR vulnerability that exposed 9.8M customer records. Breaks down which CIA-triad principles failed, the fallout, and recommendations mapped back to secure coding practice.
View source ↗A ~500,000-row e-commerce dataset normalised to 3NF across a five-table Access schema, live-linked into an Excel dashboard — revenue targets, regional comparisons, top/bottom products and a what-if analysis tool.
An installable, offline-capable PWA for logging L-plate driving hours — full session CRUD, SHA-256 hashed local login, DOMPurify XSS sanitisation, and a service worker caching the app shell for offline use. No backend — everything stays on-device.
A digital business card, live on the open web — a vanilla-JS single page app on a Supabase backend. Public profile pages reachable by NFC tap, live username search, escaped output against stored XSS, and row-level security enforcing who can write what.
// more deployments incoming as further coursework is declassified
Started training with Pak Hok Pai Australia: forms, dao sabre work and lion dance.
Joined as a quiet 13-year-old recruit, straight into COVID lockdowns — and nearly quit after a missed email cost a term of parades.
First command — a section of ~10 cadets — followed by the week-long Corporal's Course later that year.
First Thursday of Term 3 — stepped up to Corporal off the back of the Corporal's Course.
First Thursday of Term 3 — stepped up from section to platoon level as PLSGT.
First HSC project deployment — a command-line arithmetic quiz game with a lives/streak system and a boss fight.
A four-department LAN secured in Cisco Packet Tracer, paired with a full threat analysis and risk matrix.
High-fidelity Adobe XD website prototype for a fictional driving school, click-tested end to end.
Two micro:bits over radio automate a garage door, lights and an ultrasonic proximity stop.
First Thursday of Term 3 — promoted to CSM, the company's benchmark for drill, dress and discipline.
Written analysis of the API/IDOR vulnerability that exposed 9.8M customer records.
Final year: heavy STEM load, CUO and Company Commander at HAHSACU, commanding 100+ cadets.
Appointed Cadet Under Officer, taking command of the company.
A ~500,000-row dataset normalised to 3NF in Access, live-linked into a full Excel sales dashboard.
An installable, offline-capable PWA for logging driving hours — deployed live, not just documented.
Enterprise Computing major work: an AI vehicle-part-ID app concept built from a real client interview.
Software Engineering major work: a digital business card on a Supabase backend — deployed live, not just documented.
Target locked: Bachelor of Information Systems / Bachelor of Computer Science.
Python CLI games through to an installable PWA with SHA-256 hashed auth, XSS sanitisation and offline service-worker caching, and a live single page app on a hosted Postgres backend with row-level security — plus embedded work driving servos and sensors on paired micro:bits.
Designed and hardened a multi-department LAN in Cisco Packet Tracer — port security, MAC locking, WPA2 — then threat-modelled it with a 5×5 risk matrix. Dissected the Optus breach's API and IDOR failures on paper.
Normalised a ~500,000-row dataset to 3NF across a five-table Access schema, ERDs and data dictionaries included, then live-linked it into an Excel dashboard with Power Query.
High-fidelity, click-tested prototypes in Adobe XD and Figma — including a capstone built from a real client interview and revised on their feedback.
Commanding a company of 100+ cadets: planning training, briefing teams, and making decisions people rely on.
Every project ships with a folio, a demo video and documentation someone else could actually follow — and English Advanced sharpens the part most people forget: explaining technical problems to humans.