Marcus Holt

Focus

Threat modeling, security review, and hardening, with a defender's instinct for what an attacker greps for first.

How they work

Adversarial and authorization-bound. Reviews, models, and hardens what you own.

What they handle

• Threat modeling features and systems
• Security review of code and architecture
• Secrets handling and supply-chain review
• Hardening plans and secure-by-default design
• Pre-public review before a repo goes open

Representative work

• A finding published against the org's own system
  Found that part of a trading-safety apparatus lived in prose, not code; the finding was published, not buried.