Security engineering
Vulnerability research, secure-by-default architecture calls, and the review that happens before anything ships. 33 published advisories and 15 CVEs so far, three of them critical.
Chief Operations & Security Officer
at Postiz · Remote, Germany
Three maintainers. Nearly all of the execution, plus the whole of the security authority.
Areas I own
CNA operations
Running Postiz as a CVE Numbering Authority with MITRE as TL-Root. Assignment, scoring against a stated rubric, CWE chain authoring, records straight against CVE JSON 5.1, and coordinated disclosure through GHSA.
Trust, fraud and abuse
Catching platform abuse and shutting it down, plus the policy work that decides where the lines sit.
Support and community
The whole support function. Tooling, staffing, and the answers themselves. The Discord to Intercom bridge, the SLA clock and the billing console are all mine, and so is the queue.
CI/CD and releases
Build, test and release pipelines, and the deployment path they feed. The documentation site and the deployment compose stack sit here too.
Monitoring
Error tracking and metrics, and the alerting policy on top of them. Sentry for errors, custom Prometheus exporters for what Sentry cannot see. The policy is what decides whether any of it is useful.
People management
Hiring, direction, and the daily reality of a small team carrying a large surface.
Detail
What the title covers
Postiz ran with two maintainers for about two years. It's three now. At that size a C-level title doesn't mean delegating. It means the work is yours.
Still in the code
I'm the second-largest contributor to postiz-app, at 405 commits. The operating role and the engineering role are the same job. I don't sign off on a release process I didn't build, or an advisory I didn't score.
The security record
33 published advisories and 15 CVEs. Three critical, the highest at 10.0.
Two clusters dominate. Eight advisories are server-side request forgery, which is what happens when a product's core function is fetching attacker-influenced URLs on a user's behalf. Three are payment-callback issues, where an unauthenticated webhook was trusted to grant entitlements.
Both clusters needed structural answers rather than per-endpoint fixes. That is the difference between closing findings and reducing the rate at which they arrive.
The platform
Every Postiz deployment runs its workflows on Temporal. Secrets and identity go through Vault: Raft storage, a full PKI with root and intermediate CAs, ACME issuance, dynamic secrets engines, OIDC backed by self-hosted Authentik.
Monitoring is Sentry plus Prometheus exporters I wrote, tuned so that an alert means somebody should actually get up.
Support is an engineering problem
I evaluated the support stack, moved us onto it, then wrote a Discord support bot from scratch. Billing lock, refund flows, CSAT, rate limiting, canned responses.
It has since grown into a bridge between Discord and Intercom, carrying the inactivity automation, the SLA clock and a full Stripe billing console. Its largest release deleted most of its own feature surface, because every agent-side command it had was a worse version of something Intercom already did properly.
Support volume tells you what's wrong with the product. Worth capturing properly.