Built, documented, and open to inspection.
One AI system built and tested end to end, and three security labs. Each entry sets out the problem, the approach taken, and what the evidence supports.
AI product pipeline
A multi-agent commerce pipeline. CrewAI agents running on Claude research and assemble a brand guide, generate product ideas and listing copy, create design mockups through Canva's remote MCP server, publish products over the Shopify Admin API, audit SEO quality, and email a daily operational health report.
It is built to run unattended on a VPS under systemd, cycling through BUILD, DESIGN and MAINTAIN modes depending on publish limits and configured cooldowns. Each phase has been built and tested; live publishing is the final stage still being brought online. The interesting engineering is not the AI. It is everything around it that stops the AI doing something expensive.
Seven phases, four stages.
Brand
CrewAI agents research positioning, visual identity and SEO direction, then assemble a reusable brand guide.
Generate
Product ideas, titles, tags and descriptions generated from the current brand guide.
Design
Claude calls Canva's remote MCP server to generate mockups and template designs, with the Canva Connect API handling reliable exports.
Publish
Assets processed, listings validated, published through the Shopify Admin API, SEO reviewed and status reported.
Controls, not good intentions.
Credentials
API keys and OAuth tokens stay in .env; .env.example documents the required variables without exposing real values.
Scanning
gitleaks runs as a pre-commit hook and again in GitHub Actions on every pull request, alongside a pip-audit dependency check.
OAuth
Canva tokens are acquired through an OAuth PKCE setup script and Shopify credentials through a verified setup script; both are checked at preflight rather than hardcoded.
Validation
The upload flow checks title length, tag count, price range and asset readiness before any live publish.
Resilience
Calls retry with exponential backoff on rate limits and server errors; publish limits and cooldowns prevent burst automation.
Operations
SQLite tables track queue state, published listings, run logs, SEO reviews and sales, so failures are diagnosable.
The stack in full.
Languages
- Python 3.12+
- Bash shell scripting
- SQL via SQLite
- JSON payload design
AI and data
- Anthropic API (Claude)
- CrewAI
- Canva MCP server
- Serper API
- SQLite database
Platform APIs
- Shopify Admin API
- Canva Connect REST API
- OAuth2 PKCE
- Gmail SMTP digest
Deployment
- Ubuntu VPS
- systemd service
- Runtime logs
- Daily health dashboard
Three labs, worked end to end.
Self-directed work covering the parts of the job that cannot be rehearsed on live systems.
Authentication log analysis
Demonstrates detection work end to end: normalizing event data, writing the query, and defending where the threshold sits. A detection nobody trusts is one that gets muted.
Splunk · SPL · Windows Security logs
Phishing response walkthrough
Demonstrates incident handling under incomplete information, and the discipline of producing a written record that survives review after the fact.
Sysinternals · Windows Event Logs · containment
Access control workflows
Demonstrates identity governance in practice, where the difficulty is rarely technical and almost always the pressure to make an exception.
Active Directory · MFA policy · least privilege