Security by design, for the agentic era.
I'm Pedro Farinha — application security engineer and founder of ShiftLeft, a Portuguese security-by-design practice. I work on making security requirements explicit, governed, and available to the people and AI agents who write software — at the moment they write it.
My work runs on two tracks:
Security by Design
An open, governed body of security knowledge — the SbD-ToE manual, the AppSec Core ontology, and an MCP server that delivers the applicable requirements to coding agents at the point of execution.
open sourceMCPAppSecApplicationless Computing
A research programme on what comes after applications: computing as the resolution of intents, and the trust layer that consequential autonomous action requires.
researchbook in preparationElsewhere
- ShiftLeft — the practice
- GitHub
- OSF — SbD-ToE programme (DOI 10.17605/OSF.IO/7T849)