---
title: "Paul MK (@paulappsec) | Hashnode"
description: "I write the vulnerable code, exploit it, then ship the patch — so your team can see all three. Software engineer first, AppSec by consequence."
url: "https://hashnode.com/@paulappsec"
---

@paulappsec

# Paul MK

@paulappsec · Nairobi · Joined July 2026

I write the vulnerable code, exploit it, then ship the patch — so your team can see all three. Software engineer first, AppSec by consequence.

[Website](https://github.com/PaulAppSec)

### [I wrote four Semgrep rules and never ran them. Two were broken.](https://paulappsec.hashnode.dev/semgrep-rules-i-never-ran?utm_source=hashnode&utm_medium=feed)

Four Semgrep rules, carefully reasoned and never executed. Running them found two defects — including one rule that fired on the remediated code.

7 min read · [paulappsec.hashnode.dev](https://paulappsec.hashnode.dev/semgrep-rules-i-never-ran?utm_source=hashnode&utm_medium=feed)

[Aug 17](https://hashnode.com/posts/semgrep-rules-i-never-ran/6a8349300aa58983de2c4754)