I'm Andy Dixon. I build software that holds up.
Software engineering, security and applied AI. I've been writing software professionally since 1997, which is longer than Google has existed, and these days I design and build things end to end: security tooling, applied AI and the infrastructure underneath. I'm also the person teams ring when a problem crosses three departments and belongs to none of them.
Open to work. Remote roles anywhere in the world, plus freelance and consultancy projects. If it's difficult, I'm interested.
Prefer email? [email protected]. The code lives on GitHub.
- 29years professional, since 1997
- 26verifiable certificates
- 20+products, tools and extensions
Selected
projects.
Five things I designed and built. Each links to the full write-up.
-
New: a text editor, done properly
Apex
A native text editor written in Rust, in the spirit of Sublime Text. A window in about 0.2 seconds, a thousand cursors at under 4 ms a keystroke, tree-sitter for 30 languages, git built in properly and a Vim mode. No telemetry, no account, works offline, and open source.
Why it exists: my employer doesn't allow Sublime Text, and a few of us couldn't face working without it. So we're building our own. (If you can use Sublime, do, and buy the licence. It's brilliant.)
What it shows: performance work you can measure, from a rope buffer and viewport-only layout to incremental highlighting that re-colours an edit in a quarter of a millisecond.
-
Forensics, in a browser tab
Leviathan
A binary analysis and forensics workbench that runs entirely in the browser. A hex editor, an entropy map, a carver, structure parsers and twenty-odd other tools all work on the same bytes, share the same bookmarks and evidence log, and upload nothing.
Why it matters: forensics usually means a dozen disconnected tools on a machine where you can't install anything. Leviathan needs a browser and nothing else, and labels every result as solid, partial or a guess.
What it shows: twenty separate utilities rebuilt around one shared data model, with a hex editor that stays smooth on files of several hundred megabytes.
-
Post-quantum encryption
vault
A command-line vault that encrypts your files with post-quantum cryptography and hides their names, sizes and dates. Give it a decoy passphrase and it opens a different set of files, for the day someone makes you open it.
Why it matters: encrypted data stolen today can be kept and attacked later. vault wraps every key with FrodoKEM-640 and ML-KEM-768, so an attacker has to break both.
What it shows: careful cryptography in a tool normal people can use: one Rust binary for Linux, macOS, Windows and FreeBSD, crash-safe whatever order things fail in.
-
Identity without passwords
BlackWall
An OAuth 2.1 and OpenID Connect server where passkeys are the only way in. There is no password field, so there is no password to steal, phish or reuse.
Why it matters: most identity providers keep passwords as a fallback, which leaves the weakest route in permanently open. BlackWall removes it, with multi-tenant isolation, revocation and audit logging designed in.
What it shows: standards-correct work on security-critical infrastructure: mandatory PKCE, real introspection and revocation endpoints, every authorisation decision logged.
-
Terminal client
Nexus
A desktop client for people who live in the terminal. SSH and SFTP, Telnet, serial, VNC and RDP desktops, IRC and GitHub in one native Rust app, with an encrypted vault for the secrets and profile sync between machines. Now open source.
Why it matters: terminal clients tend to be either a bare SSH wrapper or a heavyweight tool with strong opinions. Nexus sits between the two: jump hosts, port forwarding, broadcast input and session recording, without a fight.
What it shows: sustained product engineering, getting dozens of small things right at once, from reconnect behaviour to how often the vault asks for a passphrase.
Expertise.
The short version. The long version involves a BBC Micro.
Software engineering
Go, Rust and PHP, from single-binary command-line tools to multi-tenant services. Small and correct beats large and half-finished.
Security
Vulnerability assessment, root cause analysis, applied cryptography, and ISO 27001 and ISO 9001 work that survives the audit.
Applied AI
Practical LLM tooling such as Squish and Basilisk, and AI that helps people rather than demoing well.
Infrastructure and operations
AWS, Prometheus, Grafana, Docker and disaster recovery, kept boring in the good way. Plus being the escalation route when a problem crosses team lines.
Articles.
Your Go Service Logs the Secret You Thought Was Redacted
A Go type that redacts itself in slog still leaks through URL errors, struct dumps and header logging. Here are the four leaks and how to close each.
Can a Manufacturer Legally Brick Your Device After a Repair?
A UK reading of what happens when an update disables a repaired device: contract terms, the Consumer Rights Act, and the Computer Misuse Act angle.
Why age Is a Better Fit Than GPG for Encrypting a Single File
age drops keyrings, trust prompts and algorithm negotiation. Here is what encrypting files with it looks like, and where GPG still wins.
Got something difficult?
A role, a project, or a problem nobody else wants to touch. Tell me about it.