Illustrated portrait of Danny

Hey, I'm Danny 👋

Security engineer in Vietnam. I build tools that run security platforms as code, products people use every day, and the occasional deep dive into how things work. Mostly Rust, Go, C, and Python.

Security as Code

Security operations should be reviewable like code. I build CLIs that pull live platform state into files, show meaningful diffs, and push approved changes back:

  • splunkctl — Splunk Enterprise, Enterprise Security, and Splunk SOAR — search, detection rules as YAML, notable triage, SOAR cases and playbooks, and configuration drift with change reports; Python, on PyPI
  • s1ctl — SentinelOne Singularity — configuration across 11 surfaces, drift detection for CI, agents, threats, remote operations, xSPM, marketplace, and Data Lake queries
  • secopsctl — Google SecOps (Chronicle SIEM and Siemplify SOAR) — detection rules, parsers, dashboards, and SOAR playbooks
  • elasticctl — Elastic Security detection rules as code across self-managed, Elastic Cloud Hosted, and Serverless deployments; written in Rust

All four preview remote changes and apply them only with --yes. Each ships a Model Context Protocol (MCP) server so AI agents use the same commands; elasticctl exposes read-only inspection tools.

Building

  • aboutme — a free, open-source resume builder for Vietnamese and English. Write a resume, publish it at its own link, and export a PDF. Go, Nuxt, and PostgreSQL; live since October 2026. Source
  • trachuan — a citable corpus of Vietnamese law for AI agents (over MCP) and people. Evidence only: verbatim provisions with citations, validity, and amendment context. In early development.

Earlier regulatory and compliance work, now archived: banhmi (ASEAN banking regulation over MCP), compliary (security framework citations), and mise (regulatory intelligence for banks).

Open Source

I publish tools I use and contribute upstream when the work belongs in a shared project.

  • onnxruntime/go — official Go bindings for the ONNX Runtime C API via CGO, merged into microsoft/onnxruntime; covers sessions, tensor I/O, I/O binding, and execution providers
  • splunk-sdk-python — Splunk SDK for Python
  • flowcvcli — controls a FlowCV resume from the command line or Python, including content, design, templates, avatar, publishing, and PDF export
show 7 Go SDKs and platforms
PackagePlatform
s1SentinelOne Singularity — agents, policies, threats, remote shell
secopsGoogle SecOps — Chronicle SIEM + Siemplify SOAR
vngcloudGreenNode (formerly VNG Cloud) — SDK and AWS-style CLI
fortigateFortiGate firewall REST API
fortimgrFortiManager FlatUI API
nessusTenable Nessus scanner (read-only)
kaggleKaggle API — kernels, datasets, token introspection