An ongoing weekly learning journal — published every Thursday in English and Portuguese simultaneously — documenting my transition from law into application security. Each post dissects a real web attack, shows how to defend against it in Django, and ships that defence as a public, runnable lab: a vulnerable view and a secure view you can clone and boot, then scan with the same off-the-shelf tools a security analyst actually uses — Bandit and Semgrep (SAST), sqlmap and OWASP ZAP (DAST), and pip-audit (SCA) — green in CI on every commit. The labs live in an open companion repository (django-security-lab), so any reader can reproduce every result with a git clone and docker compose up instead of taking my word for it. Every attack is cross-referenced to the CompTIA CySA+ CS0-003 objectives, the OWASP Top 10:2025, MITRE ATT&CK techniques, and the NIST Cybersecurity Framework.

What makes it different: proof of work is an artifact you run, not a screenshot you trust — clone the lab, point the standard scanners at it, and watch them flag the vulnerable view and stay silent on the secure one. It's grounded in real production experience from projects like Petição Brasil and paired with LGPD/regulatory analysis from my legal background. The roadmap spans the full OWASP Top 10 — Injection, Broken Access Control, Authentication & Session, Cryptographic Failures, Security Misconfiguration, Insecure Deserialization, Concurrency & Resource Abuse, Logging & Monitoring, SSRF, API Security, Software Supply Chain Failures, and Failure Modes.

Published a final paper with a perfect score of 10/10, exploring the intersection of Direct Democracy and Information Assurance. Developed a technical framework applying the CIANA Pentagon (Confidentiality, Integrity, Availability, Non-repudiation, Authentication) to validate digital petitions using ICP-Brasil PKI infrastructure and SHA-256 cryptographic signatures.

The research evolved into Petição Brasil — a live civic-tech platform described as the only Brazilian platform that unites participatory democracy and legal security. Citizens create public petitions, sign them with any ICP-Brasil certificate (Gov.br, e-CPF, A1/A3), and receive an automatically generated chain-of-custody PDF with cryptographic evidence and QR code — giving petitions the same legal standing as physical documents before public bodies, legislative chambers, and courts. The platform also enables Popular Legislative Initiative (Brazilian Constitutional Art. 61, §2º), making it the first fully digital, zero-cost path for any citizen to propose laws to Congress. LGPD-compliant, free forever, and privacy by design.

Full-stack Django application to centralize the management of judicial precatórios (court-ordered government debt instruments) issued against Brazilian public entities, built for a law firm with thousands of clients.

Tracks each precatório (government debt writ) by CNJ (Conselho Nacional de Justiça — National Council of Justice) number with independent payment statuses for three financial components: crédito principal (principal debt), honorários contratuais (contractual attorney fees), and honorários sucumbenciais (loser-pays attorney fees). Includes client/CPF (Cadastro de Pessoas Físicas — Brazilian taxpayer ID) management, alvará (court payment order) and requerimento (formal petition) workflows with configurable phase pipelines, a diligências (legal task) tracker with urgency and deadline controls, secure 50 MB PDF uploads to AWS S3, financial dashboard aggregates, and a bulk Excel import pipeline. Deployed on Heroku with PostgreSQL and gunicorn.

Engineered a proprietary payroll calculation engine in VBA and Excel to automate the computation of labor entitlements for approximately 30,000 public servants of the State of Maranhão — replacing entirely manual processes prone to error in high-stakes court submissions.

The system handled complex Brazilian labor legislation rules (cálculos trabalhistas), including overtime, vacation pay, severance, and retroactive adjustments, producing outputs with the mathematical precision required for judicial use. At peak, it processed the financial claims of the entire public education workforce of a Brazilian state.

In 2020, led the migration of the system to a web-based architecture, managing the full development lifecycle: requirements gathering, contractor hiring, and technical supervision of an external development team — delivering a production system currently at v1.4.16.