Radiation oncologist · Physician-scientist · Security researcher
I work at the intersection of medical imaging security, radiomics, and native macOS software on Apple Silicon (ARM64). I contribute defensive fixes to the open-source tools used to acquire, convert, analyze, and share imaging data, and build applications for inspecting binaries, reviewing entitlements, and preserving research data integrity.
My focus is practical: protect patient metadata and credentials, handle untrusted files safely, preserve quantitative imaging information, and make architecture-specific behavior explicit. My clinical and research interests in MR imaging and radiomics inform the problems I choose to work on.
| Application | Security and research focus | Explore |
|---|---|---|
| AIRS | Native macOS workspace for bounded ARM64 Mach-O unwind analysis and app-entitlement comparisons. Reads inspected binaries as data, with analysis coverage and unresolved results made explicit. | Download the Apple Silicon preview |
| EntitlementDiff | Review changes in declared macOS app entitlements between builds, with explicit arm64 or x86_64 selection, exact typed values, and saved comparisons colleagues can reopen. Inspects the selected main executable without launching the app. | Download the macOS app |
| DICOM Anonymizer | Local DICOM metadata pseudonymization for MR, CT, and RTSTRUCT batches. Consistently remaps patient-specific UIDs and references, audits staged outputs, and preserves source files. | Download the Apple Silicon preview |
| SidecarCompare | Review MRI acquisition-metadata changes using exact decimal comparisons, typed values, and documented units. Preserves both source sidecars and supports local snapshots and reports through a native SwiftUI app and shared CLI core. | Build the macOS app · Use the CLI |
I also develop MacScope, a private binary-analysis and reverse-engineering workbench for macOS. My related research tooling includes Prism Native MCP, which connects original observations to native GraphPad Prism tables, descriptive analyses, editable graphs, and layouts.
My upstream work addresses concrete failure modes in imaging and research software: malformed input, shell interpretation of filenames, unintended file access, credential exposure, and unreliable dependency or download handling.
| Area | Contribution |
|---|---|
| Defensive image parsing | NiBabel #1568: reject undersized NIfTI extensions before payload reads. |
| Privacy of imaging outputs | deid #304: default newly created pixel-cleaner output directories to owner-only permissions. |
| Safe report rendering | dicom-validator #301: render filenames as text in HTML validation-report headings. |
| Literal command arguments | BIDScoin #302: quote image, output, and mask paths in local SynthStrip commands. |
| Software supply-chain reliability | CycloneDX Core Java #957: recognize JSON/XML software bills of materials with leading whitespace. dcm2niix #1046: pin an optional dependency to a fixed source commit. |
The full contribution index brings together my work across medical imaging and radiomics, DICOM and NIfTI infrastructure, native macOS builds, Linux ARM64 coverage, security tooling, and research workflows. It includes code contributions, documentation, issue reports, and fork work, organized by project.
I combine source review, static binary analysis, and focused regression testing. I pay particular attention to parser boundaries, filesystem containment, credential handling, dependency provenance, and the differences between declared configuration and observed behavior.
For imaging and radiomics, numerical values, units, acquisition metadata, and source lineage matter as much as successful execution. I favor small, reviewable fixes and local tools that preserve inputs, expose failures, and make their supported scope clear.
I welcome collaboration on medical imaging security, radiomics infrastructure, defensive binary analysis, and native Apple Silicon applications. Project READMEs include setup instructions, examples, and supported workflows.