The platform everything else lives on. 14+ tools, one auth model, one CI/CD gate, one security posture.
I architected Vantage from scratch as the unified home for Ideon's internal QA tooling. It runs on AWS Elastic Beanstalk with Cognito OAuth 2.0 / PKCE auth and role-based access, and uses a layered architecture that separates test definition, execution, and adaptation concerns so changes in one layer never cascade through the others. Beyond shipping the tools themselves, I designed the security model, the deployment pipeline, and the runtime control plane.
- Designed a mandatory CI/CD quality gate: ruff, mypy, pip-audit, bandit, pytest, Selenium browser tests, and a custom SQL-suite check. No deployment proceeds without all checks green.
- Implemented a layered production security model: PKCE S256 (RFC 7636/9700), stateless HMAC-SHA256 CSRF, RS256 JWT against the Cognito JWKS endpoint with 1-hour TTL cache, HttpOnly + Secure + SameSite=Lax cookies, ALB-aware per-user rate limits, Nginx scanner-probe blocking, CORS exact-allowlist.
- Ran and resolved a full dependency security audit and a bandit code-scan audit to a clean reviewed baseline.
pip-auditandbanditgate every CI build going forward.