Application security review
Design and code reviews, threat modeling, and a secure SDLC that developers actually follow.
應用程式資安審查：設計與程式碼審查、威脅建模，以及開發團隊真的會照著走的 secure SDLC。
Samadhi Security
Security consulting
資安三昧 · 資安顧問
Calm, clear security for applications, AWS, and AI agents.
替應用程式、AWS 與 AI agent 把資安做得穩、看得清。
Services 服務
Cloud security assessment
AWS posture against the CIS benchmark, fixes for misconfigurations, and drift monitoring that shows who changed what.
雲端資安檢測：依 CIS benchmark 檢查 AWS、修正錯誤設定，並監控設定漂移、找出誰改了什麼。
AI and agent security
Guardrails for LLM applications and AI coding agents, risk assessment, and AI governance.
AI 與 agent 資安治理：LLM 應用與 AI coding agent 的護欄、風險評估與 AI 治理。
Security program and GRC
vCISO support, a security program built from zero, and controls mapped to frameworks and regulations.
資安計畫與 GRC：vCISO、從零建置資安計畫，把控制措施對應到框架與法規。
Selected work 精選作品
CloudSheriff
2026A read-only CIS drift monitor for AWS, built for the Daytona HackSprint. It takes a Prowler baseline, diffs resource snapshots, uses CloudTrail to find who changed what, and explains every regression with an LLM. Tested against a deliberately misconfigured AWS lab.
為 Daytona HackSprint 打造的唯讀 AWS CIS 漂移監控：Prowler 基準掃描、資源快照比對、用 CloudTrail 找出誰改了什麼，每個退步都由 LLM 說明原因。在刻意設錯的 AWS 靶場上實測過。
Hermes
2026A multi-agent security review assistant in Slack. One security lead routes each request to specialist reviewers (AWS, SaaS, PCI on Snowflake, AppSec, vendor risk, audit evidence, architecture) and returns a single report.
Slack 裡的資安 multi-agent 審查助手：由一個 security lead 把請求分派給 AWS、SaaS、Snowflake PCI、AppSec、供應商風險、稽核證據、架構等專家 reviewer，最後彙整成一份報告。
Guardrails for AI coding agents
2026Verification gates before every commit, hooks that catch deleted tests and weakened assertions, an allowlisted DevOps MCP server, and a blameless post-mortem of a real file-deletion incident.
AI coding agent 的護欄：每次 commit 前的驗證關卡、抓出被刪測試與被弱化 assertion 的 hook、只開白名單動作的 DevOps MCP server，以及一次真實刪檔事故的無究責檢討。
Founder 創辦人
David Shih
Security Engineer · 資安工程師
- ISC2 CISSP
- ISACA CISM
- ISACA AAISM
- PMI PMP
- AWS Solutions Architect – Associate
- AWS Developer – Associate
- AWS SysOps Administrator – Associate