Matt Deaves

@matthewdeaves
1 Followers
0 Following
7 Posts
I'm a Delivery Principal with 8 years' experience leading high-value public sector projects, working at the UK Government - Department for Science, Innovation and Technology. My background is in software engineering, which I still pursue as a hobby. I've worked on healthcare programmes including the NHS App, UK Health Security Agency, and NIHR.

Got QuakeSpasm running on a 1999 G3 with translucent water, shadows and emissive lights on. 5 → 19.80 fps on demo3 at 1024×768. +288% over the early port.

Seven rounds with Claude Code, six old Macs on a bench, one fat 3-arch binary that picks up its own autoexec config per machine.

https://www.matthewdeaves.com/blog/2026-05-09-quakespasm-six-old-macs/

A month spent pentesting two of my own projects with Claude — a Django app and the AWS infra behind it. Three levels:

1. Ask Claude
2. A curated bash scan suite in a harness that loops until clean
3. HexStrike via MCP, 150+ tools running on their own

I found and fixed 35 issues. The worst three were in the passkey login flow, and I couldn't reach them until I'd written a virtual WebAuthn authenticator.

Post + companion repo:
https://matthewdeaves.com/blog/2026-04-28-three-levels-of-ai-pentesting/

#infosec #ClaudeCode #pentest #webauthn

Three Levels of AI-Assisted Pentesting | Matthew Deaves

A month spent pentesting two of my own projects with Claude. Three escalating levels — ad-hoc review, a curated suite wrapped in a harness, and HexStrike. Here is what worked, what did not, and how to set it up against your own repo.

Matthew Deaves

Got the first alpha of BomberTalk working - a networked Bomberman clone for Classic Mac.

Played a game across a Mac SE (1987), a Performa 6200 (1994), and a Performa 6400 (1995). One C89 codebase, three builds, three machines on the same LAN.

No sprites yet, just coloured blocks. But the networking works - all three find each other and play in sync.

#retrocomputing #classicmac #gamedev #68k #PowerPC

BomberTalk Alpha https://matthewdeaves.com/blog/2026-04-06-bombertalk-alpha/

BomberTalk Alpha | Matthew Deaves

I played a networked Bomberman game across a Mac SE, a Performa 6200, and a Performa 6400. Three machines spanning 1987 to 1995, all talking to each other over TCP and UDP.

Matthew Deaves

My Virtual Pentest and DevOps Team

I built an LLM proxy on AWS and wanted to go further than perimeter defences. So I put together a pentest suite with bash, open source tools, and Claude Code. The post covers the tooling, the Claude Code skills I use to run it, and the hooks I needed
https://matthewdeaves.com/blog/2026-04-05-pentesting-rockport/

My Virtual Pentest and DevOps Team | Matthew Deaves

If you're building apps with AI and putting them live, you have to at least try to secure them. Here's how I did it with bash, open source tools, and Claude Code.

Matthew Deaves

Have you turned on Claude Code's Buddy feature? Mine's an axolotl called Rook. It caught real security issues during pentesting that Claude Code and I both missed, despite only seeing a truncated 5000 character view of the conversation.

Pentesting with Rook https://matthewdeaves.com/blog/2026-04-03-rook-the-pentest-buddy/

Pentesting with Rook | Matthew Deaves

Anthropic added a companion to Claude Code called Buddy. Mine's an axolotl named Rook. I've been running a pentest suite against Cookie and its infrastructure over the past few evenings, and Rook kept catching things I was missing.

Matthew Deaves
Guardrails for Claude Code: Hooks, Rules, and Constitutions https://matthewdeaves.com/blog/2026-03-29-guardrails-for-claude-code/
Guardrails for Claude Code: Hooks, Rules, and Constitutions | Matthew Deaves

Claude Code hooks, rules, and a project constitution enforced via GitHub Spec Kit. A primer on each layer, with a real use case: keeping ES5 compatibility on a recipe manager that runs on iPads from 2012.

Matthew Deaves

I built a self-hosted LLM proxy on a single EC2 instance. Cloudflare Tunnel, Terraform, per-key budgets, idle auto-stop, video generation sidecar. The repo is public and I'd genuinely welcome feedback from anyone who works with AWS/Terraform professionally.

Blog post: https://matthewdeaves.com/blog/2026-03-21-rockport-llm-proxy/
Repo: https://github.com/matthewdeaves/rockport

#AWS #Terraform #LLM #Infrastructure #ClaudeCode #SelfHosted

Rockport: A Self-Hosted LLM Proxy | Matthew Deaves

I built a self-hosted LiteLLM proxy on EC2 behind a Cloudflare Tunnel. It routes Claude Code traffic to AWS Bedrock with per-key budgets, idle auto-stop, and a video sidecar for video generation and image operations. The repo is public and I'd welcome feedback from anyone who works with this sort of infrastructure.

Matthew Deaves