Software engineer

Corey
Leavitt

I write systems software and the tools around it, mostly in Rust, Nim, and Python. Since 2016: most of it building and running a manufacturer's data platform, lately open-source tooling.

Selected work → Read the blog

Open to senior and staff engineering roles, contract or permanent — remote across the US or Mexico, or hybrid around Boston — and to consulting through Knurlsoft.

// about

Most of my open work now is developer infrastructure: a testing engine that puts property testing, coverage-guided fuzzing, and symbolic execution on one core; a package registry where a signing attestation, not a human, gates publishing; a reactive runtime whose scheduler is formally verified in Lean 4. Mostly in Nim, with fixes upstream in the compiler and in russh. For the decade before that I built and ran the data platform at a lithium-ion battery manufacturer, shop-floor systems through the Azure side, and led the team behind it, until the company closed in March 2026.

Worcester, MA · B.S. Chemistry, Northeastern · Spanish fluent · full history on LinkedIn ↗

// selected work

Languages & developer tooling

A testing engine ↗

Property testing, coverage-guided fuzzing, and Z3-backed symbolic execution on a single choice-sequence core.

intonaco · nim · lean 4

Compile-time reactive ↗

A compile-time-first signals library whose glitch-free scheduler is formally verified in Lean 4.

tianguis · milpa

Signing-gated registry ↗

A keyless, cosign-signed Nim package registry where a Sigstore attestation, not human review, gates publishing, over milpa's offline-verifiable, content-addressed lockfiles.

Security & low-level

Pre-auth DoS in russh ↗

An unbounded allocation reachable before authentication, found by aiming the fuzz harness at real attacker surface. Reported and fixed upstream.

openwrt · ipq40xx

Ruckus H510 → OpenWrt ↗

A from-scratch device-tree port of an EOL enterprise access point: serial console to persistent install, with a recovered SPI-NOR brick on the way.

sello · cryptography

Zero-dep Curve25519 ↗

Pure-Nim ed25519 and X25519 with no FFI in the core, down to an in-house SHA-512. Constant-time signing, split from testable verification.

Platform & AI

amoxtli · private

Multi-agent AI runtime

A container-isolated agent runtime with persistent memory and multi-agent campaigns. Private; walkthrough on request.

flareid · knurlsoft

Entra ID auth for Ignition ↗

An Ignition module that authenticates SQL Server and Azure SQL connections as Entra ID identities, so the plant floor stops running on shared database credentials.

Impact-aware test running ↗

A host-side Nim test runner that, given a diff, runs only the entrypoints whose dependency closure the change can reach.

DNS content filtering ↗

A Technitium DNS Server plugin with a Litestar web UI and 480+ tests.

Also upstream: Nim compiler fixes and russh contributions, byobu OpenBSD support, and smaller libraries: oxifish (Twofish on PyPI), nkdl, softlink, and chapulin.

// stack

Languages: Python · Rust · Nim · C# · F# · Kotlin · C · SQL
Backend: REST APIs · OAuth2 / OIDC · RabbitMQ · PyO3 / FFI · SQL Server
Infrastructure: Azure · Docker / Swarm · Linux · Prefect · CI/CD
Practices: TDD · property-based testing · AI-assisted development

// writing

nelli: one engine for property testing, fuzzing, and symbolic execution 2026 CVE-2026-42189: a pre-auth DoS in russh, found by fuzzing the right state 2026 Porting the Ruckus H510 to OpenWrt 2026 Cautionary tale: bricking an AP with a 4-byte SPI NOR write 2026

All writing →

// get in touch

Email

corey@leavitt.dev

GitHub ↗ LinkedIn ↗ Blog ↗ Resume (PDF) ↗

Consulting

Security consulting and product work runs through my company, Knurlsoft ↗.