---
title: Carter LaSalle — Security Researcher & Software Engineer
description: Security researcher, Lila Sciences software engineering intern, and Notre Dame computer science student building secure systems and open-source tools.
canonical: https://carterlasalle.com
last-updated: 2026-10-12
---

# Carter LaSalle

Security researcher, Lila Sciences software engineering intern, and Notre Dame computer science student building secure systems and open-source tools.

## About

I'm a Computer Science and Political Science student at the University of Notre Dame and a published security researcher. My work spans vulnerability disclosure, network security, developer tools, applied AI, and systems that meet the physical world.

## Selected work

- [Mac Messages MCP](https://github.com/carterlasalle/mac_messages_mcp): A secure MCP server that gives AI assistants controlled access to the macOS Messages database—search, analyze, and send with intelligent iMessage and SMS/RCS fallback. (44K+ package downloads)
- [Prometheus / FireDrop](https://github.com/carterlasalle): Computer vision and drone integration for continuous wildfire detection, tracking, and faster situational awareness. (Phoenix Fire Labs · Co-Founder)
- [scc](https://github.com/carterlasalle/scc): Compiles code, config, infrastructure, runtime, and intent into an evidence-backed machine model, then emits task-specific context packs for AI coding agents. (Rust · Tree-sitter · MCP)
- [launchpad-platform](https://github.com/carterlasalle/launchpad-platform): A Git-driven internal developer platform for Vercel and Cloudflare with YAML desired state, PR plans and previews, drift reconciliation, health gates, rollback, and exact-commit promotion. (TypeScript · Vercel + Cloudflare)
- [ozzgraph](https://github.com/carterlasalle/ozzgraph): An autonomous security-research harness: a model-adaptive agent supervisor with SQLite graph state, provenance, bounded actions, and pluggable environment adapters. (Python · bounded, policy-gated execution)
- [carter-omp](https://github.com/carterlasalle/carter-omp): A self-hosted GitHub coding agent with explicit label and mention triggers and capability-bound tools. (Python · MIT)
- [RepoSeal](https://github.com/carterlasalle/RepoSeal): A supply-chain firewall for AI coding agents. (Rust · security tooling)
- [AgentGate](https://github.com/carterlasalle/AgentGate): A security firewall for AI agents. (Rust · security tooling)
- [seed-harness](https://github.com/carterlasalle/seed-harness): A self-evolving coding-agent harness in which an immutable Rust guardian judges an evolvable TypeScript/Python organism, with Pareto promotion. (Rust + TypeScript · Apache-2.0)
- [sessionwatch](https://github.com/carterlasalle/sessionwatch): A live TUI for watching SSH and terminal sessions: real usernames, tmux/screen session names, and every process they spawn, in real time. (Rust · Linux)
- [LeakLens](https://github.com/carterlasalle/LeakLens): Scans working trees and Git history using patterns plus entropy, with redaction, baselines, SARIF output, a pre-commit hook, and a GitHub Action. (Python · MIT)
- [bughunt](https://github.com/carterlasalle/bughunt): A defense-in-depth bug-finding orchestrator for Python repositories. (Python · static analysis)
- [bugcorpus](https://github.com/carterlasalle/bugcorpus): Compiles historical bugs into permanent, deterministic detectors. (Python · MIT)
- [Detection-Replay-Lab](https://github.com/carterlasalle/Detection-Replay-Lab): Replays synthetic macOS and Linux event traces against tested Sigma rules, explains matches, and measures false positives. (Detection-as-code)
- [cachepilot](https://github.com/carterlasalle/cachepilot): Cost-aware KV cache lease optimization and a nonblocking long-task runtime for Hermes Agent. (Python · Apache-2.0)
- [skills](https://github.com/carterlasalle/skills): An independent agent-skill collection with custom-created skills. (Python · MIT)
- [autolight](https://github.com/carterlasalle/autolight): An automated lighting designer for DJs: Rekordbox and Serato in, Govee RGBIC out, with local-first show control. (TypeScript · Electron)
- [glowgo](https://github.com/carterlasalle/glowgo): GlowGo, a mobile spray-tan marketplace to find, book, and review vetted mobile artists, built on Next.js, Convex, and Flutter. (TypeScript · Next.js + Convex)
- [openmeteo-sunstack-tanscore](https://github.com/carterlasalle/openmeteo-sunstack-tanscore): A strict, source-transparent solar and UV forecast plus calibration stack: absolute melanogenic intensity compared with local outdoor opportunity, published on a schedule. (Python · Open-Meteo)
- [aipromptxml](https://github.com/carterlasalle/aipromptxml): A Prompt XML helper for structuring prompts. (JavaScript · MIT)
- [homebrew-tap](https://github.com/carterlasalle/homebrew-tap): A personal Homebrew tap for shipping the tooling above. (Ruby · Homebrew)
- [carterlasalle-lp-live-20260805](https://github.com/carterlasalle/carterlasalle-lp-live-20260805): A disposable Launchpad live-acceptance sandbox. (HTML · disposable)
- [treecat](https://github.com/carterlasalle/treecat): A Go CLI and interactive TUI that turns codebases into syntax-highlighted context for LLMs, documentation, and code review. (Homebrew + native packages · automated releases)
- [NetSift](https://github.com/carterlasalle/NetSift): A dependency-free packet-capture explorer that defensively decodes PCAP and PCAPNG files into terminal answers and deterministic structured output. (Dependency-free runtime · cross-platform CI)
- [PixelChangeCheck](https://github.com/carterlasalle/PixelChangeCheck): A Rust screen-sharing system that transmits changed regions through direct QUIC, relay-backed NAT traversal, native viewers, and zero-install browser viewing. (Direct QUIC + relay NAT traversal)
- [EmojiStega](https://emojisteg.is-a.dev): A steganography tool that hides encrypted payloads inside emoji variation selectors, exploring a covert channel in Unicode. (Encrypted Unicode covert channel)
- [Stamina Timer](https://staminatimer.com): An AI-assisted men's health training platform built around structured exercises, progression, and confidence. (staminatimer.com · production)
- [Claude Code Countdown](https://www.claudecodecountdown.com): Tracks Claude Code rate-limit resets and sends timely SMS reminders before access returns. (Live service · Twilio notifications)
- [OneCard Scan](https://onecard-capstone.vercel.app): Digitizes student IDs for Apple Wallet and Google Pay using Gemini Vision and mobile pass tooling. (Senior capstone · deployed prototype)

## Security research

- [Splashin security assessment](https://carterlasalle.com/blog/splashin-security-assessment): Responsible-disclosure research covering two published access-control vulnerabilities.

## More

- [Technical writing](https://carterlasalle.com/blog)
- [Full machine-readable profile](https://carterlasalle.com/llms-full.txt)
- [GitHub](https://github.com/carterlasalle)
- [LinkedIn](https://linkedin.com/in/carter-lasalle)

## Contact

- Email: carterlasalle@gmail.com
- Contact form: https://carterlasalle.com/#contact