Software engineer — distributed systems, security, and AI agents.

MSc Computer Science, TU Delft, graduated August 2026. My thesis studied how the wording of a security instruction changes the code an AI coding agent writes.
Based in Delft, available now, looking for work in the Netherlands.

MSc thesis framework that mutates the natural-language security rules given to a code-generating LLM and searches, with an evolutionary algorithm, for phrasings that reduce static-analysis findings. Evaluated against Cisco's Project CodeGuard, Qwen2.5-Coder-32B and Llama-3.3-70B, with Semgrep as the oracle.

An agent that specialises itself by rewriting its own prompt, tools and memory, behind an immutable kernel that owns evaluation, gating and rollback. Candidates run sandboxed in Docker behind a validation gate. Built in one week as the technical assignment for a JetBrains internship application.

A mechanism preventing double-spending offline for EuroToken, a peer-to-peer Android application built on the TU Delft TrustChain ledger, using Bloom filter broadcasting over Bluetooth LE to disseminate spent-token data. I owned the token layer: representation, signing, local store, withdrawal, and the offline transfer validator.

Event-driven microservices coordinating checkout through a Saga orchestrator, tolerating service, broker and database failure without downtime. I built the stock service, the Redis optimistic-concurrency layer and the replicated Kafka cluster.

Coverage-guided fuzzing of a Raft implementation, guided by abstract model states from a TLC model checker. I implemented the state-path representation behind the k-path coverage guider.

Co-led a two-person build of a tool turning raw security-smell detector output into a triage workflow with refactoring guidance. I built the parser, the JPA/SQLite persistence layer and the smell detail interface. Basis of the publication below.

Energy and carbon study of GPU video transcoding across JVM JIT profiles, measured under load against a Spring Boot transcoding server and extrapolated to the daily footprint of a commercial video server.

Desktop tool showing developers where a Gradle build spends energy, measuring individual tasks across repeated, warmed-up and idle-corrected runs. It ships on my EnergiBridge fork, where I patched a duration-underflow crash.

Android application for browsing, filtering and reviewing beers, built on a repository pattern over a remote API with a local cache and federated authentication.

The thread running through the work above is bounded autonomy — giving an agent real room to act inside a boundary it cannot move.

• I study how they fail. My thesis starts from the observation that coding assistants now load external instructions as a task demands, and asks whether retrieved security rules still hold when they are reworded. Often they do not.
• I build them. Stem Agent's kernel owns evaluation, gating and rollback, and the agent cannot modify it. Every candidate is sandboxed and has to pass a validation gate before it is accepted.
• I engineer my own workflow with them. I wrote three Claude Code skills to run my thesis end to end — HPC job submission behind a seven-point pre-flight that refuses to submit on failure, experiment-result analysis, and cross-machine sync of an issue database between laptop and cluster — and I run agents under a permission policy that denies git push, rm, sudo, and reads of .env and key material.

• SST: A Tool to Support the Triage of Security Smells in Microservice Applications — F. Ponce, A. Malnati, R. Negro et al. SN Computer Science 5, 1014 (2024). doi.org/10.1007/s42979-024-03372-5
• Comparing H.264 and H.265 video decoding energy consumption — M. Chan, R. Negro, J. Seyidova, G. Margadant. TU Delft Sustainable Software Engineering, 2025.

A note on this account. I created it in November 2024, part-way through my master's, so the contribution graph does not reach back to my bachelor's. The work from 2021–2024 — SST and BeerAdvisor above — lives in the repositories linked here, under my collaborators' and the research group's accounts.

The forks here are reading, not decoration: the agent frameworks and security tooling I work against — OpenHands, SWE-agent, mcp-scanner, kube-hound — plus Project CodeGuard, which my thesis evaluates and ships as a submodule, and EnergiBridge, which I patched.