DDevineSecurity Engineer

Security-first

Live Security Posture

This portfolio doesn't just talk about security - it proves it. Real-time checks across all 5 live projects, all 0 vulnerabilities, all security headers enforced.

⚡
God Mode Active - Full Hardening 2026-09-12
All Next.js 16.3.5 + React 19.2.8 + postcss 8.5.28, 0 vulns, AES-256-GCM, CSP nonce + strict-dynamic, HSTS preload, 5 security engines in Chokepoint (risk, policy-sim, SIEM CEF/OCSF/LEEF, impersonation, compliance), fleet risk heatmap in Device Tool, OTEL + Prometheus + replay in Reset Lab, PWA offline-first + security.txt in Endopima, self-hosted fonts + CSP in Github.io, WebAuthn + View Transitions demos.

Live Security Posture

Real-time security status across all deployed projects. All checks run client-side, no PII collected. Proves the portfolio practices what it preaches.

Portfolio

SecureLOW RISK
Live:https://devine-nyaenya-portfolio.vercel.app
Tests:100% headers
Controls:
CSP nonceHSTSX-Frame-OptionsPermissions-Policy
Last deploy
2026-09-11

Chokepoint

SecureLOW RISK
Live:https://chokepoint-demo.vercel.app
Tests:26 tests - ledger, authz, crypto, anomaly
Controls:
CSPHSTSHMAC auditHash chain
Last deploy
2026-09-11

Android Device Management

SecureLOW RISK
Live:https://android-device-management-tool.vercel.app
Tests:Security hardened - 0 vulns
Controls:
CSPHSTSAES-GCMRate limit
Last deploy
2026-09-11

Android Reset Lab

SecureLOW RISK
Live:https://android-reset-lab.vercel.app
Tests:52 tests, 6/6 detection
Controls:
Hash chainHMACArgon2idTOTP
Last deploy
2026-09-09

Endopima Kenya

SecureLOW RISK
Live:https://nyaenya-devine.github.io/endopima-kenya/
Tests:Privacy-first, no PII, PWA offline
Controls:
CSP metaNo trackersLocal-firstPWAesc() XSS fix
Last deploy
2026-09-12
0
Critical Vulns
78+
Security Tests
5
Live Demos

Threat Model Explorer

User Credentials
Brute Force
Rate limit + Argon2id + lockout
Mitigated
Audit Log
Tampering
Hash chain + HMAC + verifyChain()
Detected
Session Cookie
Hijacking
HttpOnly + SameSite=Strict + signed
Mitigated
AI Agent
Privilege Abuse (ASI03)
RBAC + dual-control + impersonation detection
Mitigated
Encryption Keys
Exposure
AES-GCM + env-only + fail-closed
Mitigated
🔐

WebAuthn / Passkey Demo — God Mode

Client-side only, no server, no collection

Demonstrates passwordless auth using platform authenticator. Credentials never leave device. Proves security engineering beyond passwords — progressive enhancement, fails gracefully if unsupported.

Not supported
Ready — passkeys stay on this device, no server.

Security note: challenge and userId are random via crypto.getRandomValues (CSPRNG). attestation=none, no PII. This is a demo — production would verify assertion on server with stored public key.

✦

View Transitions API — God Mode

Progressive enhancement, no-JS fallback

Native View Transitions provide fluid morphing between states without SPA framework overhead. If unsupported, it degrades to instant switch — portfolio keeps no-JS contract.

Audit Log
Hash-chained HMAC ledger — tamper-evident, 52 tests
viewTransitionName: panel — morphs smoothly when supported

What Was Hardened (God Mode Log)

Phase 1 - Critical Vuln Fixes — DONE
  • android-device-management-tool: 7 vulns → 0 vulns via Next 16.3.5 + postcss 8.5.28 + esbuild 0.25.0 override
  • portfolio + chokepoint: Next 16.3.5, React 19.2.8, @types/react-dom 19.1.11
  • crypto.ts: AES-256-CBC → AES-256-GCM, fail-closed, CSPRNG randomInt, secure secret generator
  • next.config: full security headers (CSP, HSTS preload, X-Frame DENY, Permissions-Policy)
Phase 2 - Inventive Features (Chokepoint) — DONE
  • riskEngine.ts - Behavioral risk scoring (velocity, privilege creep, after-hours, impersonation, ASI03)
  • policySimulator.ts - Dry-run policy testing, 6 default tests
  • siemExport.ts - JSON, CEF, OCSF, LEEF export
  • impersonationDetector.ts - 5 impersonation types
  • complianceMapper.ts - NIST, SOC2, MITRE, OWASP, ISO27001 auto-mapping
  • 5 API routes + 4 dashboards: fleet-risk, compliance, simulation, time-travel
Phase 3 - Portfolio & Other Projects — DONE
  • Portfolio: SecurityPostureDashboard + /security-posture + WebAuthn + View Transitions + Header link
  • Device Tool: FleetRiskHeatmap integrated into FleetDashboard, 0 vulns, build passes
  • Reset Lab: OTEL tracing + Prometheus /metrics + /api/traces + /api/replay + Bandit + pip-audit CI
  • Endopima: PWA manifest + sw.js offline-first + CSP meta + security.txt + esc() sanitization
  • Github.io: self-hosted fonts (no Google), CSP meta, nosniff, referrer-policy, performance