Dossier
Freelance Cloud Platform & AI Security Engineer, based in Casale Monferrato, Italy. I help teams and companies make their cloud infrastructure reliable and secure: automation, pipelines, hardening, internal tooling. I work alongside the client's team, in pair programming rather than black-box handovers, so they stay autonomous. Python is the main tool for automation, internal tooling and application security.
Security is not a final polish: secrets management, automated CI gates and a written threat model are part of the delivery, not of a later engagement. When a model sits in the middle the list gets longer: prompt injection on content coming from outside, AI Act transparency, the software supply chain. What's left at the end of a job is tests that run, documentation that reads, and a team able to work on it without me.
Services
Six ways to work together. Below, what each one includes; if your problem fits none of them, write to me anyway.
Security Audit
A repeatable inspection of the whole stack, from AI to OS: find the exposed tokens and weak configs before anyone else does.
AI & Agent Security
Putting AI agents into production without opening holes: human oversight is designed, autonomy is earned with caps and guardrails, never granted by default.
AI Automation
Custom AI solutions that remove repetitive work: agents, RAG and pipelines that run on their own, with human oversight where it matters.
Cloud & Automation
Infrastructure that carries the weight, and the trust, of the people using it. Provisioning, pipelines and containers, with reliability as a requirement.
Pair & Advisory
The primary way of working: hands-on, at your side. No black box handed over: we build together and your team stays autonomous.
Web Development
Fast, polished sites, like the one for Vetreria Monferrina: Astro + CMS, Lighthouse 100, security and accessibility by default, with an AI agent for SEO/AEO if needed.
Not a shopping cart: a starting point. Select what you need, how and for how long: I generate a draft brief you can copy or email me in one click.
No published rates: every engagement is sized to the real problem, not to a one-size-fits-all price list. The first conversation is always free and no strings attached. Pair programming, not prompt-and-go.
Field Notes
One case at a time from a system running in production: problem, approach, result, lesson learned. No theory, only things that actually happened.
Agentic OS — Claude Code telemetry, in production
Every Claude Code session streams its telemetry into a hub I built, and a public widget on this site reads three numbers back out of it. Measured against the real client (v2.1.220), Claude Code sends five identity attributes alongside the metrics, and one of them carries my actual email address. Anything that reaches Prometheus becomes a label, and a label is forever.
The first version deleted the five known attributes. That is a deny-list, and a deny-list at a privacy boundary fails open on everything it has not heard of yet: Claude Code telemetry is in beta, its attribute set is not a contract, and the next release can add a sixth. The Collector now keeps an allow-list of six known keys and drops the rest, before batching, so an unknown attribute becomes a missing label rather than a leak. Verified against the real client, including attributes no released version emits yet.
Identity never reaches storage at all. The whole hub is five services on Railway with a single ingress, behind a Cloudflare Tunnel, and its public surface is three aggregate numbers: sessions, tokens, cost. When the hub does not answer, the site prints three dashes instead of a zero, because a zero would look like an answer.
The cost of the trade is written down rather than hidden: a new producer whose labels are not on the list will watch them vanish in silence. That is the direction I want it to fail in. Deleting what you know about protects you until somebody else ships their next release.
Magazine
One real case a month on AI, security and governance at work: the problem, the call made, what changed. A pipeline writes it, checked against the sources. The first one is point zero: ideas get better as you go.
N.02AUGUST 2026 · software-engineeringAI coding tools are everywhere now, but they don't make teams faster on their own
READ
AI coding tools are everywhere now, but they don't make teams faster on their own
READBack in 2019, a software engineer might have heard about deep learning breakthroughs in computer vision or translation, but few imagined a direct impact on their own daily work. Five years later that has changed dramatically: GitHub's survey of 2,000 people on software development teams across the U.S., Brazil, India, and Germany found that more than 97% of respondents had used AI coding tools at work at some point, a finding consistent across all four countries. The open question is what happens after that first use: a smaller share of respondents said their companies actively encourage AI tool adoption, showing that individual enthusiasm doesn't automatically turn into organizational adoption.
Google built its response inside the internal development environment where engineers spend most of their time, working on both the inner loop (IDE, code review, code search) and the outer loop (bug management, planning), building on the ML-based code completion it had already rolled out internally. The team frames this as part of an ongoing transformation of internal tooling rather than a one-off project. On the measurement side, the 2025 DORA report on AI-assisted software development takes a different angle: instead of asking whether AI works in the abstract, it looks at how AI amplifies whatever dynamics, good or bad, already exist inside an organization.
The picture that emerges is not one of automatic productivity gains. The 2025 DORA report concludes that AI does not automatically improve software delivery performance; instead it acts as an amplifier of the practices and organizational conditions already in place. At the same time, GitHub's survey shows near-universal individual adoption (97% having used AI tools at least once) paired with uneven company-level support, with only a smaller share of companies actively pushing adoption. These are two sides of the same transition: the tools have reached everyone, but the organizational payoff hasn't caught up yet.
Engineering leaders can't treat AI adoption as a simple switch to flip: if delivery practices are already solid, AI amplifies the gains; if they're weak, it amplifies the weaknesses too. The useful first step isn't counting how many people use an AI tool, it's checking whether the company is genuinely backing that use with consistent incentives and processes, because widespread individual use, as the 97% figure shows, doesn't by itself guarantee better team performance.
Back issues · the stack of the ones before
Edicola · where the byline also runs
Projects
Three models from three different providers, set up to disagree with each other, because one LLM on its own tends to tell you what you want to hear. They answer separately, rank each other blind, then an outside chairman sums up. I use it before decisions that actually cost something.
A model’s eagerness to agree is not a prompting problem: it sits in the weights, put there during training. An LLM used for decision support will confirm whatever direction you signal, including the wrong one.
Python standard library only, zero runtime dependencies, and the dev tools pinned by hash rather than by version number: the supply chain is as small as it gets, and verified on every build. Three independent voters through OpenRouter with anonymised answers, blind cross-ranking, and a chairman picked from outside the voter pool so it cannot vote for itself. Anthropic is excluded on principle: whoever runs the council does not sit on it.
Public repo under MIT, 100% coverage across three Python versions, plus a weekly mutation run that checks whether those tests can actually fail. A full mapping of the OWASP LLM Top 10 in SECURITY.md, with the out-of-scope items named and justified.
Turin, rush hour: where do you leave the car? An API that answers in real time, built security-first as if it had been in production for years: async FastAPI, PostGIS for geospatial, Redis with ETags. Next stop: the App Store.
Knowing in real time where there's a free spot in Turin meant jumping between different sources, with no single clean, fast API to query.
Security-first API: async FastAPI on Python 3.12, PostgreSQL 16 + PostGIS for geospatial, Redis 7 with compression and conditional ETag requests, HMAC-SHA256 on API keys (zero plaintext), multi-tier sliding-window rate limiting.
51 tests across unit, integration and e2e with testcontainers, CI/CD and a threat model documented in SECURITY.md. Next milestone: bringing it to the Apple App Store as a native app.
How much work I actually do with AI, measured instead of claimed. Claude Code ships its telemetry to a hub of my own, five services behind a tunnel, and on this page three real numbers update by themselves.
AI-assisted work gets discussed in anecdotes. I had no idea how much of it I was doing, with which models, at what cost, and no tool would tell me without shipping my sessions to somebody else.
OpenTelemetry from Claude Code into a Collector that authenticates the ingest and applies an allow-list on labels: anything not declared safe never becomes a metric. Prometheus stores, Grafana displays behind Cloudflare Access, and a status API exposes exactly three aggregate numbers: no free-form queries, no session content.
In production on Railway behind a Cloudflare Tunnel, with no service exposed on a public platform domain. The allow-list came from a measurement, not from a reading: my real email address was arriving as a Prometheus label, and the obvious fix silently lost data.
The philosophical experiment of the lot: an Obsidian knowledge graph asking how memory and identity get built over time. Shelved as a product, irreplaceable as a thinking tool, and the RAG-powered SaaS idea is still on the table.
Scattered notes didn't talk to each other: ideas, readings and projects ended up isolated instead of connected.
A personal knowledge graph on Obsidian, meant not just as an archive but as an open question about how memory and identity are built over time.
Deprioritised as a product against whatever was actually shipping, but it remains the thinking tool I use most, and the idea of a SaaS version with RAG is still on the table.
Career
Full Stack & AI Engineer
A production site (Astro + Sanity) and an AI agent for SEO/AEO with RAG on Supabase and AI Act governance.
Full Stack Engineer
Full-stack work on an enterprise debt-collection platform: a Python back-end (Clean/DDD) on AWS serverless and a multi-role React/TypeScript SPA.
Software Engineer
Software for critical infrastructure: 24/7 video supervision for Rome Metro Line C and enterprise network diagnostics for Etihad Airways (Scapy).
Stack
Python & Backend
Home turf: back-ends and APIs built on Clean Architecture and DDD (FastAPI, Flask, Falcon). Frontend: Astro and Vite, this site included; React and TypeScript when a SPA is called for.
Security
OWASP hardening, PII encryption (AES-256), threat modeling and a written audit in the repo; CI security gates: Bandit, CodeQL, Gitleaks.
AI Security
OWASP LLM Top 10 on a RAG that runs in production: prompt injection defence on content coming from outside, LLM-as-a-judge as a CI gate, EU AI Act transparency (art. 50), MITRE ATLAS as the threat map.
AI & Agents
RAG with citations (Voyage embeddings), guardrails and human review inside the flow, evals: on Claude API and the Model Context Protocol (MCP).
Supply Chain
CycloneDX SBOM and signed provenance attestation (keyless OIDC) on every deploy, dependencies pinned by SHA, zizmor on the workflows, gitleaks across the whole history.
Cloud & IaC
AWS (Lambda, SQS, S3, IAM, VPC), Kubernetes / K3s, Terraform, Cloudflare Tunnel.
Database
PostgreSQL + PostGIS, Redis, MongoDB, SQLite FTS5, for geospatial work and high-performance caching.
Deploy & Observability
Docker and K3s, CI/CD on GitHub Actions; Sentry, Langfuse, Prometheus and Grafana.
Certifications · each verifiable at the source
Security
This page audits itself. The table below is not a claim. It is read live from the response headers your browser just received.
$ security headers served by this page
SOURCE: HEAD SELF · LIVEreading response headers…
Headers are applied at the edge (Cloudflare) and read live from this page’s response, so locally they may show as missing.
The terminal on this page prints text written by a model. Keeping that text from becoming code is not a matter of trusting the model: the page has to refuse to run anything inline. Those last two rows are that refusal, read from the policy your browser just enforced.
Booking
Thirty minutes, free, no commitment. Time zone handled automatically, email confirmation, without messages back and forth to find a time. If we then work together, the first day is on me unless it convinces you.
CAL.EU — LOADED ON REQUEST
The calendar is served by Cal.eu, a third party. Nothing is loaded, and nothing leaves your browser, until you click.
