Profile / open to work
Full-stack developer · Application security
I build web products end to end and test them the way an attacker would. Currently studying Computer Science at UniMol, and looking for full-stack or application security work.
Full-stack
01Next.js/TypeScript on the surface, Node/Fastify and SQL underneath. One internal production dashboard, public projects, tests and CI.
Application security
02OWASP-focused review, reproducible findings and regression tests. One public training lab; no paid pentests claimed.
A live snapshot from GitHub: the repositories I am working in, the issues I closed, and the ones still open.
Repos in use
Top 3, this site excluded
Done
05
To do
04
Last updated: 23 Oct 2026
Education, work and public milestones. Exact dates where they exist; ranges where they do not.
21 OCT 2026
Now19 OCT 2026
Personal project
Faster ducking, event-driven PipeWire state, live tray menus and DBusMenu integration tests. MIT.
08 OCT 2026
Open source
Started contributing — since then I have changed +1115 / −44 lines across 15 files.
2025 — PRESENT
Università degli Studi del Molise (UniMol)
Currently enrolled. The degree runs alongside the projects and the security practice.
17 JUN — 31 AUG 2024
Packly Prinigraf SRL
Occasional autonomous collaboration on an internal real-time dashboard for production devices: Next.js/TypeScript, Fastify/Node, JWT/cookie auth, SQLite, Socket.IO and CI.
2019/20 — 2024/25
Istituto Tecnico G. Marconi, Campobasso
Five-year technical track. The foundation under everything else on this page.
Grouped by where I actually use them. No percentages; public evidence is linked where it exists.
The interface layer: static export, responsive layout, motion with a reduced-motion escape hatch.
The part that has to survive real data and real users. One internal production dashboard; public evidence is thinner and described as such.
Native code, Linux plumbing and the build chain around it.
Early-career and public: notes, tests and a reproducible lab, not a certificate collection.
The boring infrastructure that keeps changes reversible.
Italian is the native language. English is the working language for code, docs and reviews.
The paid work is short and recent. The public track record is growing. Both are listed without inflation.
17 JUN — 31 AUG 2024
Campochiaro (CB) · internal project, code not public
Packly Prinigraf SRL
Occasional autonomous collaboration on an internal real-time dashboard for production devices. The contract defines a fixed scope; the project and customer data stay private.
13 OCT 2026
Open source · +1115 / −44 · 15 files
napi-bindings/marmotta
Upstream contributions to Marmotta’s Zig toolchain and build pipeline, with a focus on cache isolation, diagnostics and regression coverage.
19 OCT 2026
MIT · v1.2.0
PipeDuck
C++20 PipeWire ducking daemon with smooth return fades and microphone-triggered ducking. The 1.x line moved state reading to a single libpulse event subscription and added live tray menus.
21 OCT 2026
Next.js · TypeScript · static export
No certifications and no paid pentests. One deliberately vulnerable local API, documented from scope to regression test.
Public proof / training lab
Authentication works. Object-level authorization does not. Alice logs in and reads Bob's invoice; the fixed build returns 404 and the regression test proves both states.
05 / Availability
Open to full-stack or application security roles. Based in Italy, working remote on EU time. No certifications yet: the security work is public and reproducible, and the rest is on this page.
CV updated October 2026 · errusso.github.io