Arnold Castro

Cloud Security Specialist

No production data or customer traffic.

AI-built. Security-reviewed.

Cloud security proofs of concept

Prowler

Live

Defense in depth on a live system across AWS, GCP, and Azure.

Launch Prowler Code for Prowler on GitHub

prowler.cloudsecuritypractice.com

  • 19/19 Prowler scan findings remediated, verified by re-scan
  • Dashboard runs 24/7 on Cloud Run, reachable only through Cloudflare CDN, proxy, and WAF
  • 5 CI gates on every change: supply chain, SAST, secrets, IaC, containers
  • The supply-chain gate blocks malicious packages, not just vulnerable ones
  • The AI build agent ran sandboxed, with egress allowlisting

LoonVault

Beta

A cloud data platform mapped control by control to OSFI B-13.

Launch LoonVault Code for LoonVault on GitHub

loonvault.cloudsecuritypractice.com

  • 20 OPA tests gate every Terraform plan, each rule tied to the OSFI principle it enforces
  • Blocks open SSH, public buckets, and out-of-region resources before deploy
  • Least-privilege AWS in ca-central-1, behind Cloudflare WAF and rate limiting
  • RDS IAM auth with no stored credentials, private no-NAT subnets, customer-managed encryption
  • Full data path validated end to end: API Gateway, then authorizer, then Lambda, then RDS
  • STRIDE threat model, region-lock SCP as code, org-wide CloudTrail
  • The AI build agent ran sandboxed, with egress allowlisting

NextDetection and response, with Prowler on the same control map.