● SYSTEMS // SECURITY // OWNERSHIP

UNDERSTAND THE SYSTEM.PROTECT THE DATA.

Adrian Hernandez builds security-minded systems by asking what they do, why they work, and what happens when they fail. The goal is simple: keep information private, keep control with the owner, and understand every layer involved.

VIEW PROJECT INDEX ↓CONTACT OPERATOR
01 // PROJECT SYSTEMS

ACTIVE PROJECT INDEX

These projects grew out of curiosity, practical problems, and the need to keep learning. They are built to be useful and understandable, with information kept local whenever possible and every connection made for a reason.
EMBEDDED SECURITYACTIVE
01 // SENTINEL

Dead-man recovery is Sentinel’s defining workflow. The ESP32-C6 appliance remains offline while protecting the recovery components required to reconstruct encrypted data. Separate primary and recovery PINs, a randomized keypad, persistent lockout, session expiration, PBKDF2-HMAC-SHA256 credential derivation, per-credential salts, a device-held pepper, constant-time comparison, zeroization, and encrypted local storage protect access. If the owner misses the configured check-in threshold, Sentinel performs its only network operation: sending a designated contact procedural instructions for handling the device and its recovery material.

OFFLINE BY DEFAULT // BREAK-GLASS NOTIFICATION // OWNER CONTROL

ESP32-C6 · ENCRYPTED VAULT · DEAD-MAN RECOVERY
WIRELESS OBSERVATIONCONCEPT
02 // WATCHER

Watcher is an ESP32-S3 passive wireless-observation concept designed to turn nearby network activity into understandable telemetry. Its scope includes device discovery and identification, traffic-volume trends, destination awareness, protocol visibility, and behavioral pattern monitoring. It observes and reports; it does not route, filter, inject, or control traffic.

PASSIVE TELEMETRY // NO TRAFFIC INTERVENTION

ESP32-S3 · DEVICE DISCOVERY · PROTOCOL VISIBILITY
CONVERSATIONAL DEVICECONCEPT
03 // AYVUM

AYVUM is a purpose-built ESP32-S3 conversational interface reduced to one interaction: hold to speak, submit the question, and receive a spoken response. The embedded device handles the physical input, session state, and playback interface while external services provide speech processing, reasoning, and voice generation. The design intentionally avoids nested menus and general-purpose UI complexity.

HOLD TO SPEAK // DIRECT RESPONSE // PURPOSE-BUILT UI

ESP32-S3 · VOICE PIPELINE · MINIMAL INTERFACE
SYSTEMS LABORATORYONGOING
04 // INFRASTRUCTURE

A seven-segment VMware homelab built around OPNsense policy enforcement and least-privilege inter-segment routing. Kali Linux, Ubuntu Server CLI, Windows 11, Windows Server, Tails, IoT devices, mobile devices, and other peripherals are separated by function and allowed to communicate only across explicitly required service paths. An ESP32-S3 operates as the wireless access point. Selected public services are published through outbound Cloudflare Tunnel connections, avoiding direct exposure of origin addresses or inbound service ports.

SEGMENTATION // LEAST-PRIVILEGE FLOWS // OUTBOUND TUNNEL

OPNsense · VMWARE · MULTI-OS · ESP32-S3 AP
02 // PUBLIC IDENTITY

OPERATOR RECORD

PROFILEPUBLIC
Adrian Hernandez
CYBERSECURITY STUDENT // SYSTEMS BUILDER
Focused on understanding why systems work, how they fail, and how to recover them. His work spans network infrastructure, systems administration, embedded security, applied encryption, and human-centered technical tools.

He is especially interested in how keys, credentials, encrypted data, and recovery components work together. Additional layers provide value only when their purpose is understood and they are implemented correctly.
EDUCATIONCURRENT RECORD
MASTER’SCybersecurity and Information AssuranceIN PROGRESS
BACHELOR’SNetwork Systems AdministrationCOMPLETED
ASSOCIATETechnical SupportCOMPLETED
OPENPGP PUBLIC KEYPUBLISHED
ED25519 [SC] // CV25519 [E]
PRIMARY FINGERPRINT
5D2B 8F74 C672 BAAF 9E76 6D20 763C DA13 60A2 678D
Signing, certification, and encryption · Created 2026-08-17 · Expires 2028-08-16
DOWNLOAD PUBLIC KEY ↓
03 // RESTRICTED SYSTEM

PRIVATE COMMAND NODE

The operational dashboard is separate from the public edge. It is protected by its own access policy. There is no internal network addressing or topology exposed here.

ENTER COMMAND NODE ↗