Cloud security analyst · governance · automation
Ethan Justice
I govern cloud environments for a Fortune 500 insurer by day, and run my own infrastructure like production by night.
- 1,100+
- GCP projects governed
- 11
- releases shipped
- 13
- containers, tested restores
- 12.7k★
- project, one fix of mine open
this page is the first exhibit
I could tell you I take this seriously. Instead: attack it. Every button below runs a real attack against this page, in your browser, right now. Nothing is simulated and none of the verdicts are written by me — they are the browser refusing, and reporting why.
These attacks run in JavaScript, and you have it switched off, so there is nothing here to run. The page still works without it — which is the other half of the same argument.
the policy your browser reports enforcing, read from its own violation event
And here is everything this page fetched to show you itself. Not a claim in a footer — your browser's own record, counted against this domain.
Selected work
Things I built, and what they prove.
Cloud security
Sanitized case studies from cloud security work at a Fortune 500 insurer.
- A container supply chain gap closed at the source, not patched downstream
- 1,100+ GCP projects validated and mapped to an owning application
- Alert enrichment automated, so a finding arrives actionable
- Recurring misconfigurations turned into policy that denies them at creation
Makimono
A feature-driven fork of Mihon, the open-source Android manga reader. 11 releases, real users, updates itself.
drive the reader →Friday & Jarvis
Two self-hosted voice assistants, architecturally isolated. Friday runs my infrastructure. Jarvis is the one strangers are allowed to talk to.
try to break it →Homelab
A Proxmox node run with production discipline: restore-tested backups, network segmentation, self-healing services.
trace the traffic →Mealie fork
A fork of Mealie I build, deploy, and extend, plus an upstream fix for the nutrition data it was poisoning into schema.org output.
see the bug →This site
Static, self-hosted fonts, zero third-party requests, strict CSP. It does not ask you to believe that: it attacks itself and prints the browser's own verdict.
attack it →