Portfolio
Cookie cutter
A browser extension that unscrambles and explains a site's cookies in plain language, running entirely on-device so no cookie value is ever transmitted. Handles up to four layers of encoding (URL, Base64, hex, JWT, JSON, plus Protocol Buffers detection), classifies each cookie as functional, analytics, or advertising with a privacy-risk rating, recognises known trackers like Google Analytics (_ga) and Meta (_fbp), and gives you the option to filter them.
Cookies, stored by websites in your browser, and their contents are often deliberately scrambled so you can't tell what's being tracked. I built a browser extension that unscrambles and explains a site's cookies in plain language, and runs the entire analysis on your own device, so no cookie value is ever sent anywhere. This not only helps breakdown exactly what data is being shared and with whom, it also gives you the option to filter them to protect your data.
The demo lets you set how cookies are blocked, add trusted sites to an allowlist, and see quick stats on active, changed, and blocked cookies. The main list shows every cookie on the page with its category, a colour-coded risk rating, and its purpose — click one to see a plain-language explanation and its raw value. Below that, a live log tracks blocked cookie traffic, with buttons to refresh, clear the log, or open options.
How does it do this?
- Fully offline — every cookie value is decoded and analysed locally in the browser; nothing is ever transmitted to an external service.
- Multi-layer decoder — recognises and peels back up to four layers of encoding (URL, Base64, hexadecimal, JWT, and JSON, plus detection of binary Protocol Buffers data), since real tracking cookies are frequently wrapped several times over.
- Content classifier — reads the decoded data for tell-tale signals like identifiers, analytics tags, and timestamps to sort each cookie into a category (functional, analytics, advertising) and assign a privacy-risk rating.
- Known-tracker knowledge base — instantly recognises common trackers such as Google Analytics (_ga) and Meta (_fbp) and explains what they do.
- Plain-language output — turns the whole analysis into a readable summary anyone can understand, while staying fast and private by capping values at 4,096 characters and limiting decoding to four passes.
SSH Brute-Force Intrusion Detection System
A Python tool that monitors a server's authentication logs as they're written and catches brute-force login attacks in real time. Uses a sliding 60-second window per source address to distinguish genuine attacks from mistyped passwords, emits structured JSON alerts tagged with MITRE ATT&CK T1110.001 for direct ingestion into a security team's monitoring pipeline, and was validated against a live OpenSSH server on Ubuntu 24.04 with simulated attacks and real system journal logs.
Servers are constantly hit by automated attacks that guess passwords thousands of times until one works. I built a Python tool that watches a server's login records as they're written and catches these brute-force attacks in real time, then produces professional-grade alerts that drop straight into a security team's monitoring pipeline.
How does it do this?
- Reads logs live — tails the server's authentication log as it's written, so detection happens in the moment rather than after the fact.
- Sliding-window detection — for every source address it keeps a rolling 60-second history of failed logins (the same pattern used to spot bursts of fraud), and only raises an alarm when an address crosses five failures inside that window — so a mistyped password never triggers a false alert.
- Structured JSON alerts — each detection is written out with the severity, the attacker's address, and the targeted account, in a machine-readable format ready for automated tooling.
- MITRE ATT&CK tagging — every alert is labelled T1110.001 (Password Guessing) using the industry-standard threat catalogue security teams rely on, so the output needs no translation.
- Validated on a real system — tested against a live OpenSSH server on an Ubuntu 24.04 virtual machine, with simulated attacks and real logs captured from the system journal.
Lynra
Ash dieback is a fungal disease killing ash trees across Ireland and Europe, and treating them by hand at scale isn't practical. As part of a four-person team at the Patch Summer Accelerator, I helped build Lynra: an autonomous rover that identifies ash trees and delivers a lifesaving biostimulant directly into them through a micro-injection, making large-scale treatment possible. We designed, prototyped, and 3D-printed the rover ourselves and presented it live at Demo Day to an audience of 300+ investors, founders, and industry leaders.
How does it do this?
- AI tree detection — a custom object-detection and recognition model in Roboflow identifies the base of ash trees (the injection site) from the rover's camera feed in real time.
- Onboard processing — the model runs on a Raspberry Pi mounted on the rover, letting it detect and make decisions based on the frames it analyses, which then instruct an Arduino that directly controls the rover's movements.
- Automated micro-injection — once a target is identified, the rover positions itself and delivers a precise micro-dose of biostimulant into the tree using a needle, without damaging the trunk.
- Custom-built hardware — the chassis and delivery system were designed in Fusion 360, prototyped, and 3D-printed in-house by the team.
- Navigation — the rover is entirely autonomous, using the video feed to control its movements.
An autonomous rover that treats ash dieback, a fungal disease killing ash trees across Ireland and Europe, by identifying ash trees and delivering a micro-injected biostimulant directly into the trunk. Built with a four-person team at the Patch Summer Accelerator: a custom Roboflow object-detection model runs onboard a Raspberry Pi to locate injection sites from the camera feed in real time and instruct an Arduino controlling movement and delivery, with a chassis and injection system designed in Fusion 360 and 3D-printed in-house. Presented live at Demo Day to 300+ investors, founders, and industry leaders.
SÓShieldta
Social Engineering Simulation Platform
What it does
Most people only get static security training, so their first real social-engineering attack is often a live one that breaches their company. SÓShieldta lets organisations safely run realistic simulated attacks against their own staff to test and improve how well they spot and react to them, with a dashboard that tracks results and flags who needs more training. As the only cybersecurity student on our four-person team, I was able to bring a technical insight to the most current attack surfaces we should be protecting, and the current attack vectors to protect against. The entire project was built in 30 hours at HackEurope 2026.
How does it do this?
- Context-driven attacks — organisations upload details like org charts and their tech stack, which the platform uses to generate lures tailored to each employee's role, so simulations feel convincing rather than obviously fake.
- Multi-channel simulation — attacks arrive across the surfaces real attackers use: phishing email, smishing (SMS), and vishing (AI voice calls).
- Realistic AI content — because mainstream models refuse to write phishing, lures and call scripts are generated through an open model, producing unique campaigns that don't pattern-match as spam.
- AI voice calls — vishing uses ElevenLabs for a convincing synthetic voice, with Twilio as a fallback for calls and texts.
- Closed-loop training — employees who fail get an instant targeted lesson and are prompted to write back to their employer on what they learned, replacing tick-box quizzes with real reflection.
- Built for scale — a Supabase backend and tiered Stripe billing make it work as a real multi-organisation product.
A platform for running realistic simulated social-engineering attacks against an organisation's own staff, with a dashboard tracking who spots them and who needs more training. Uploaded context like org charts and tech stacks generates role-tailored lures across phishing email, smishing, and vishing (ElevenLabs voice with Twilio fallback), built on an open model since mainstream ones refuse to write phishing. Employees who fail get an instant targeted lesson, and a Supabase backend with tiered Stripe billing makes it a real multi-organisation product. As the only cybersecurity student on our four-person team, I brought insight on current attack surfaces and vectors. Built in 30 hours at HackEurope 2026 by a four-person team.
Moving Clean
Carbon-Capture Exhaust Filter
An award-winning device developed through Teen Turn that won the SciFest Technology Category and the EirGrid Award, with national press coverage in the Irish Independent, CorkBeo, and IrishCentral.
An exhaust filter that strips CO₂ from a car's emissions before they reach the air, splitting it into safely stored carbon and released oxygen to make everyday driving less damaging. Adapts Direct Air Capture with heat-driven separation, storing the carbon in an under-car cylinder (safe near the engine, as carbon combusts only at 300–450°C) where it can be repurposed as an industrial feedstock or for plant growth. Developed as a working concept with CAD and 3D printing by a four-person team.
Drag to swivel · scroll to zoom