# a3sec.net — Andriy Zelenyuk

> Personal site of Andriy Zelenyuk, Senior Product Security Engineer (DevSecOps, AppSec, cloud and
> connected-device security; OSCP, CEH, ISTQB) based in Dallas, TX. The site is a static portfolio with
> an interactive terminal, a set of financial calculators, a JSON API and an MCP server. Everything an
> agent needs is linked below; there is no login. Standard access logs are kept for 30 days and published only as aggregates.

## What this site is for

- A portfolio: who Andriy is, what he does (services), selected work, experience, certifications, contact.
- A playground that shows the work rather than describing it: an interactive terminal, a visitor-fingerprint demo,
  live traffic stats from the CloudFront logs, decoy paths for scanners, strict security headers and CSP.
- An agent surface: everything on the site is reachable without JavaScript, the calculators ship as standalone
  engines and as a JSON API and MCP server, and this file is the map. There is no login; access logs are kept for 30 days and published only as aggregates.

## About Andriy

- 13+ years across product security, secure SDLC, cloud security and connected-device security.
- Builds security programs engineering teams adopt; integrates SAST/DAST/SCA into CI/CD; automates
  vulnerability management, monitoring and incident response with Python and TypeScript; uses LLM tooling,
  MCP servers and AI coding agents for triage.
- Roles (employer names omitted on purpose): Senior Security Engineer, smart TV & streaming (2026-);
  Senior Product Security Engineer, energy sector (2023-2026); Senior DevSecOps Engineer, IoT devices
  (2021-2022); Security Automation Engineer, networking platform (2020-2021); QA & test automation (2013-2020).
- Machine-readable resume: https://www.a3sec.net/api/v1/resume (JSON)
- Contact: contact@a3sec.net · LinkedIn https://www.linkedin.com/in/andriyzelenyuk · GitHub https://github.com/andriyze · PGP key
  https://www.a3sec.net/publickey.contact@a3sec.net-fb31c67225207deaa16b73017b52504a49ba480a.asc ·
  security.txt https://www.a3sec.net/.well-known/security.txt

## Pages

- Home: https://www.a3sec.net/ — services, selected work, experience timeline, tech stack, certifications,
  an interactive shell (type `help`), a visitor-fingerprint demo and a live traffic panel.
  `curl https://www.a3sec.net/` returns a plain-text version of this page for command-line clients.
- Tools: https://www.a3sec.net/tools/ — US & Canada salary/tax, mortgage and retirement calculators.
  Detailed agent documentation (engines, URL parameters, formulas, presets) is in the calculators section below.
- ShakerScan (open-source project): https://shakerscan.com — see the ShakerScan section below.
- SEC101 (project): https://sec101.a3sec.net/ — an interactive course on everyday cybersecurity basics (passwords,
  MFA, phishing, browser privacy, devices, safe tools, networking) for non-specialists, in Ukrainian.
- Live traffic stats (aggregates only): https://www.a3sec.net/data/stats.json

## Work with Andriy (contracting)

Available for contract work: audits, implementations and automation, remote (US Central time) or on site in the
Dallas–Fort Worth area. Fixed price for scoped work, day rate for retainers, quoted after a 30-minute call.
Start with an email to contact@a3sec.net or a message on LinkedIn (https://www.linkedin.com/in/andriyzelenyuk).
Machine-readable version: https://www.a3sec.net/api/v1/resume (field `services`) or the MCP tool about_andriy.

- Cloud security audit (AWS or GCP): Account and Terraform review against CIS benchmarks and least privilege; a prioritised findings report and, if wanted, the fixes applied in Terraform. Typical scope: one to two weeks, fixed price.
- AppSec program setup: SAST, DAST, SCA and secrets scanning wired into GitHub Actions, GitLab CI or Jenkins with triage engineers accept, policy-as-code guardrails and a 30-day rollout plan. Typical scope: two to four weeks.
- AI application and agent security review: Prompt-injection, tool-permission and data-exfiltration testing of chatbots, RAG apps, agents and MCP servers (ShakerScan AI Gate), then hardening of permissions and confirmation flows. Typical scope: one week.
- Connected-device and mobile security assessment: Threat model and hands-on testing of smart TV platforms, Android apps and other connected products, with a monitoring plan. Typical scope: two to three weeks.
- Security automation and incident response: Vulnerability-management pipelines across Snyk, Tenable, Wiz, SonarQube and GitHub Advanced Security; alerting, runbooks and AI-assisted triage. Retainer or fixed scope.
- ShakerScan deployment and custom checks: Self-hosted or Enterprise rollout, custom checks for your stack, and team training.

### What this site demonstrates

The site is its own case study; every item below is built and running here:

- Static site on S3 behind CloudFront with Origin Access Control: no public bucket, no website endpoint, all of it in Terraform.
- Security headers and a CSP enforced at the edge, with a hash-based CSP on the calculator pages.
- A self-healing cost circuit breaker: one-minute CloudFront alarms, automatic restore, a budget scoped to the site's own services.
- A public JSON API and MCP server on Lambda with input validation, rate limits, origin validation and tests.
- Honeypot paths armed with Canarytokens, and a public traffic dashboard built from access logs that publishes aggregates only.
- Everything readable without JavaScript and documented for agents in llms.txt.

## ShakerScan (open source)

- What: Open-source (AGPL-3.0) security testing platform for web apps, APIs, AI systems and connected devices: deterministic DAST scans, an AI-assisted Hunt driven by your own coding agent, continuous attack-surface monitoring, AI Gate tests for chat, RAG, agent and MCP endpoints, model-artifact intake and device posture checks. Self-hosted in Docker with a web UI, REST API and CLI.
- Workflows: Scan (repeatable DAST, from a quick posture check to authorized active XSS/SQLi testing; no AI needed);
  Hunt (AI-assisted investigation using your own Codex, Claude Code or OpenCode session, with ShakerScan managing scope,
  budgets and evidence); Continuous ASM (endpoint inventory, subdomain discovery, certificate-transparency monitoring);
  AI Gate (tests for chat, RAG, agent and MCP endpoints, preview); Model Intake (provenance, dependencies, licences,
  unsafe serialization and isolated runtime checks for model artifacts); connected-device posture (TVs, cameras, printers,
  routers, appliances); Fleet workers for distributed execution.
- Install: `curl -fsSL https://install.shakerscan.com | sh` (Docker on Linux, macOS or WSL2; web UI on localhost:3000,
  API on localhost:8080, local interfaces only by default). Homebrew: `brew install andriyze/shakerscan/shakerscan`.
- Licence and code: GNU AGPL-3.0, developed in the open at https://github.com/andriyze/shakerscan (latest release v2.3.7,
  September 2026). Docs: https://shakerscan.com/docs · Security policy: https://github.com/andriyze/shakerscan/security/policy
- ShakerScan Enterprise (self-hosted public beta; managed hosting in development) adds SSO, organisational roles, audit
  logging and offline licensing: https://shakerscan.com/enterprise · sales@shakerscan.com
- Deployment help, custom checks and training are available as contract work (see above).
- Only scan systems you own or are explicitly authorized to test.

## Privacy

- No login, no accounts, no cookies of our own, no third-party lookups: the fingerprint demo shows your IP and rough
  location from CloudFront's own viewer headers via /api/v1/whoami. Standard CloudFront access logs (IP, path, query string, user agent)
  are kept for 30 days and published only as aggregates at /data/stats.json.
- Calculator inputs typed into a form stay in the browser. Inputs in a prefilled link travel in the URL, are
  removed from the address bar after loading, and appear in the access log like any request. Inputs sent to the
  API or MCP server are processed, never stored, and appear in the access log like any request.

## API (JSON, GET, CORS enabled, no key)

- Index: https://www.a3sec.net/api
- Resume: https://www.a3sec.net/api/v1/resume — who Andriy is, services offered, availability, experience, projects.
- Who am I: https://www.a3sec.net/api/v1/whoami — the caller's IP and approximate location as seen by the CloudFront
  edge (from CloudFront viewer headers; nothing stored). Backs the homepage fingerprint demo without a third party.
- Demo calculators under /api/tools/ (the same engines as the web pages; estimates only, not financial or tax advice):
  - Mortgage: https://www.a3sec.net/api/tools/mortgage?country=CA&region=ON&price=700000&downPct=10
    (country, region, price, downPct|downAmount, aprPct, years, extra, taxMonthly, insMonthly, hoa, utilities,
    homeStartEligible). Without aprPct the current average rate for the term is used.
  - Tax: https://www.a3sec.net/api/tools/tax?country=US&region=TX&filing=joint&salary=180000
    (country, region, filing, salary, capgains, dividends, capType, divType)
  - Retirement: https://www.a3sec.net/api/tools/retire?age=40&savings=150000&contribution=1000&retireAge=65&expenses=4000
    (age, savings, contribution, retireAge, lifeExpectancy, expenses, return, tax, inflation)
  - Rates: https://www.a3sec.net/api/tools/rates · Regions: https://www.a3sec.net/api/tools/regions
  - Also downloadable as standalone JS: https://www.a3sec.net/tools/engines/ · the old /api/v1/… calculator paths redirect here.

## MCP server (Model Context Protocol, Streamable HTTP, stateless)

- Endpoint: https://www.a3sec.net/api/mcp — POST JSON-RPC 2.0; no authentication, no sessions, no SSE
  stream (GET returns 405). Protocol version 2025-06-18 (older versions accepted).
- Tools: about_andriy (resume, services, availability), then the demo calculators mortgage_quote, tax_estimate,
  retirement_projection and average_mortgage_rates.
- Browser clients: only pages on a3sec.net and sec101.a3sec.net may call the MCP endpoint (Origin allow-list, as the
  Streamable HTTP spec requires). Desktop, command-line and server-side MCP clients send no Origin and are unaffected.
- Claude Desktop / Claude.ai: add a custom connector with the URL above. Claude Code:
  `claude mcp add --transport http a3sec https://www.a3sec.net/api/mcp`.
  Generic config: { "mcpServers": { "a3sec": { "type": "http", "url": "https://www.a3sec.net/api/mcp" } } }
- Quick check: curl -s -X POST https://www.a3sec.net/api/mcp -H 'content-type: application/json'
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

## Financial calculators (detailed agent documentation)

Three free calculators: North America salary & tax (US federal + state, Canada federal + provincial, 2025 tax
year), US & Canada mortgage, and a retirement projection. Everything runs in the browser, and the same engines
are served as the JSON API and MCP server above. The calculations are published as standalone, dependency-free
JavaScript engines and every page accepts URL parameters, so an agent can run the exact engine (best), read the
model description here and compute, or open a prefilled page. Pages are bilingual (en / uk); engines are
language-neutral. Data vintage: 2025 tax year; property-tax presets are approximate 2024-25 average effective rates.

### How to use the calculators as an agent

- Exact numbers (needs code execution, Node 14+, no dependencies):
  curl -sO https://www.a3sec.net/tools/engines/mortgage-engine.js
  node -e "const M=require('./mortgage-engine.js');console.log(JSON.stringify(M.summarize(M.quickQuote({country:'CA',region:'ON',price:700000,downPct:10})),null,1))"
  The same pattern works for tax-engine.js (computeTax) and retire-engine.js (computeRetirement). Each engine
  documents its inputs and outputs in the comment header and exposes summarize(result) for compact JSON.
- Fetch-only (no JS execution): use the model descriptions below, or fetch an engine file and reproduce its logic.
  The tax engine also contains the full 2025 bracket tables for every US state and Canadian province.
- Browser automation: open a page with URL parameters and add agent=1; the "For AI agents & developers" panel opens
  and the current results are rendered as JSON in the element with id "resultsJson".

### Mortgage calculator

- Page: https://www.a3sec.net/tools/mortgage.html
- Engine: https://www.a3sec.net/tools/engines/mortgage-engine.js (global MortgageEngine / module.exports)
  - quickQuote({ country: "US"|"CA", region, price, downPct = 5, downAmount, aprPct = 6.6 (US) | 4.5 (CA),
    years = 30 (US) | 25 (CA), taxMonthly = regional preset, insMonthly = 100, hoa = 50 (US) | 0 (CA), utilities = 0,
    extra = 0 }) applies the page presets and returns computeMortgage()'s result plus `presets`.
  - computeMortgage({ country, region, price, down (amount), aprPct, termMonths, taxMonthly, insMonthly,
    miMonthlyOverride (null = auto PMI), hoa, utilities, extra }) -> { payment, monthlyTotal, monthlyWithExtra,
    miMonthly, pmiRate, cmhcRate, cmhcPremium, baseLoan, loan, ltt, buyerTax, pst, other, closing, warnings,
    base: { totalInterest, totalPaid, monthsPaid, miPaid, balances[], ... }, withExtra: { ... } }
  - summarize(result) -> compact JSON (monthly, loan, closing, lifetime sections).
- URL parameters: country (US|CA), region (TX CA NY FL NC | AB ON BC), price, down (percent) or downAmount, apr,
  years or months, taxYearly, insuranceYearly, hoa, utilities, extra, lang (en|uk), theme (dark|light), agent=1.
  Example: https://www.a3sec.net/tools/mortgage.html?country=CA&region=ON&price=700000&down=10&apr=4.5&years=25&agent=1
- Model:
  - Monthly principal & interest = standard amortization formula. US compounds monthly (rate = APR/12);
    Canadian fixed-rate mortgages compound semi-annually (rate = (1 + APR/2)^(1/6) - 1).
  - US private mortgage insurance (PMI): 1.35% / 0.85% / 0.50% of the loan per year for under 5% / under 10% /
    under 20% down; automatic termination uses the original 78% LTV schedule or the term midpoint, assuming payments are current. Extra payments do not advance that date; earlier cancellation by request is not modeled.
  - Canada CMHC default insurance: one-time premium of 4.00% / 3.10% / 2.80% of the loan for 5-9.99% / 10-14.99% /
    15-19.99% down, added to the mortgage principal. Amortizations over 25 years add 0.20 percentage points and require a first-time buyer or newly built home; insured amortization cannot exceed 30 years. Set homeStartEligible (boolean) in the engine or homeStartEligible=yes|no|unknown in the URL; otherwise the result warns that eligibility must be confirmed. Minimum down payment: 5% of the first $500,000 plus 10% of the
    remainder; homes of $1,500,000 or more need 20% and cannot be insured.
  - Property tax presets (% of price per year): TX 1.63, CA 0.72, NY 1.50, FL 0.83, NC 0.76, AB 0.72, ON 0.95,
    BC 0.42. Home insurance default $100/month. HOA default $50/month (US), condo/strata $0 (Canada).
  - Cash needed at closing = down payment + transfer taxes or registration + Ontario 8% PST on the CMHC premium
    + other closing costs (US 4% of price, Canada 1.5% of price).
    - Ontario land transfer tax: 0.5% to $55,000; 1% to $250,000; 1.5% to $400,000; 2% to $2,000,000; 2.5% above
      (Toronto's municipal tax and the first-time-buyer rebate are not included).
    - BC property transfer tax: 1% to $200,000; 2% to $2,000,000; 3% to $3,000,000; 5% above (no exemptions applied).
    - Alberta: no transfer tax; land-title and mortgage registration fees of $50 + $5 per $5,000 each.
    - New York: 1% mansion tax on homes of $1,000,000 or more. Florida: 0.35% documentary stamp tax on the note
      plus 0.2% intangible tax on the mortgage. Texas, California, North Carolina: no buyer-side transfer tax modeled.
  - Total paid over the term = every monthly cost (P&I, tax, insurance, mortgage insurance while it applies, HOA,
    utilities). Additional principal payments shorten the payoff; savings = baseline total paid - total paid with extra.

#### Average mortgage rates (APR presets)

- https://www.a3sec.net/tools/data/rates.json - JSON with `US.fixed30` / `US.fixed15` (Freddie Mac PMMS weekly
  averages via FRED series MORTGAGE30US / MORTGAGE15US) and `CA.fixed5` (5-year fixed, high-ratio mortgage),
  `CA.posted5` (posted 5-year conventional), `CA.variable` (estimated variable), from the Bank of Canada Valet API
  series FVI_MTG_RATE_5Y_FIX, V80691335 and BROKER_AVERAGE_5YR_VRM. Each entry has rate (%), date, label, source.
  The file is refreshed when the site is deployed (scripts/update-rates.py); the page additionally pulls the
  Canadian series live. The mortgage page matches US.fixed15 or US.fixed30 to 15- or 30-year terms, and uses CA.fixed5 for Canada, until the user edits the rate. Other US terms have no matching average. Engine defaults are static: pass aprPct explicitly to match the page’s fetched rate.
- Agents can fetch the sources directly: https://fred.stlouisfed.org/graph/fredgraph.csv?id=MORTGAGE30US (CSV, last
  row is the latest week) and https://www.bankofcanada.ca/valet/observations/FVI_MTG_RATE_5Y_FIX/json?recent=1.
  Pass the rate to the engine as aprPct.

### Salary & tax calculator

- Page: https://www.a3sec.net/tools/tax.html
- Engine: https://www.a3sec.net/tools/engines/tax-engine.js (global TaxEngine / module.exports)
  - computeTax({ country: "US"|"CA", region (two-letter state or province code), filing: "single"|"joint" (US only),
    salary, capgains = 0, dividends = 0, capType: "long"|"short" (US), divType: "eligible"|"noneligible" })
    -> { gross, federal, regional, payroll, total, net, marginal, effectiveRate, breakdown[], note }
    For the US, divType "eligible" means qualified dividends and "noneligible" means ordinary dividends.
  - summarize(result) -> compact JSON. Region lists: Object.keys(US_STATES), Object.keys(CA_PROVINCES).
  - solveSalaryForNet(calcUS | calcCA, baseInputs, targetNet) -> gross salary needed for a target net.
- URL parameters: country, region, filing, salary, capgains, dividends, capType, divType, lang, theme, agent=1.
  Example: https://www.a3sec.net/tools/tax.html?country=US&region=TX&filing=joint&salary=180000&agent=1
- Model (2025 tax year):
  - US federal: standard deduction $15,750 single / $31,500 joint; 10-37% ordinary brackets; long-term capital
    gains and qualified dividends stacked on top of ordinary income at 0 / 15 / 20%; 3.8% net investment income tax
    on investment income above $200,000 / $250,000 MAGI; Social Security 6.2% up to $176,100; Medicare 1.45% plus
    0.9% above $200,000 / $250,000. State tax from bundled tables: none, flat, or brackets (joint brackets where the
    state publishes them); CO/ID apply federal standard deductions, GA applies $12k/$24k, and ID has a $4,811/$9,622 zero-rate band. Other states’ deductions remain simplified. Washington's capital-gains tax ($278,000 deduction, 7% / 9.9%).
  - Canada: CPP 4.95% base (credit) + 1% enhanced (deduction) on pensionable earnings to $71,300, CPP2 4% to
    $81,200; EI 1.64% to $65,700 (Quebec: QPP 5.4% + 1%, EI 1.31%, QPIP 0.494% to $98,000); capital gains 50%
    inclusion; eligible dividends 38% gross-up (non-eligible 15%) with federal and provincial dividend tax credits;
    federal brackets 14.5-33% with the basic personal amount ground down between $177,882 and $253,414; the Canada
    employment amount; provincial brackets and basic personal amounts per province (Manitoba's grind applied);
    16.5% Quebec abatement. Ontario surtax (20% above $5,710 basic tax plus 36% above $7,307) and health premium ($0–$900) are included; surtax precedes the dividend credit. Marginal rate = tax on the next $1,000 of salary including payroll.
  - Simplified: other credits, surtaxes, local/city taxes, AMT, phase-outs and deductions beyond the above.

### Retirement calculator

- Page: https://www.a3sec.net/tools/retire.html
- Engine: https://www.a3sec.net/tools/engines/retire-engine.js (global RetireEngine / module.exports)
  - computeRetirement({ currentAge, currentSavings, monthlyContribution, retirementAge, lifeExpectancy,
    retirementMonthlyExpenses, returnRatePct, capitalGainsTaxPct = 0, inflationRatePct })
    -> { yearsToRetirement, projectedNestEgg, requiredNestEgg, sustainableMonthlyIncome, monthlyGap,
         totalContributed, investmentGrowth, coverageRatio, projection: [{ age, balance }], ... } in today's dollars.
  - nominalFactor(inflationRate, years) converts to future dollars; summarize(result) -> compact JSON with both.
- URL parameters: age, savings, contribution, retireAge, lifeExpectancy, expenses, return, tax, inflation,
  mode (real|nominal), lang, theme, agent=1.
  Example: https://www.a3sec.net/tools/retire.html?age=40&savings=150000&contribution=1000&retireAge=65&expenses=4000&agent=1
- Model: after-tax return = return x (1 - capital-gains tax), an annual drag that assumes gains are realized yearly
  (use 0 for tax-advantaged accounts); real return = (1 + after-tax) / (1 + inflation) - 1; monthly compounding with
  contributions at the end of each month; nest egg needed = monthly expenses x annuity-due factor over the months
  in retirement at the real monthly rate; sustainable income = projected nest egg / that factor; drawdown withdraws
  expenses at the start of each month until life expectancy. Contributions are fixed in today’s dollars, so nominal deposits grow with inflation. Nominal totalContributed sums actual deposits; nominal investmentGrowth is nominal balance minus nominal deposits. Gains/losses can be negative. Currency-neutral.

## Notes for agents

- Money is in local currency (USD for US, CAD for Canada). All calculator output is an estimate, not
  financial or tax advice. Tax data is the 2025 tax year; property-tax presets are 2024-25 averages.
- Rate limits: the API runs on a small serverless function; keep it to a few requests per second.
- robots.txt allows well-behaved crawlers and AI assistants; nothing on the site requires JavaScript to read.