I build AI agents for security, and the tools I need along the way. Everything I learn, I share.
Tech Lead at RedCarbon. I write mostly Go.
What you learn, you must share.
- Co-founder of Schrödinger Hat · an open source community of 20k+ people across Europe
- Co-organizer of Open Source Day · 500+ attendees in Florence, every year
Argus is an open-source application security agent: it runs real scanners, reasons over their findings with your organization's context, and answers back in plain language. Terminal chat, GitHub pull requests, MCP.
docker run -it -v argus-data:/data -p 8080:8080 ghcr.io/argusappsec/argusIt is early, and that is what it needs: people running it on real code. Try it, then tell me where it gets things wrong.
And for myself, because the tools I want rarely exist:
- tsundoku keeps my books and comics: what I am reading, what I finished, what comes next.
- kanpai will do the same for wine and spirits. In progress.
- Decisions get written down. ADRs sit in the repo next to the code they explain, so the reasoning survives the commit.
- I publish what I learn, including what did not work. I Built a Tool I Don't Use is the retrospective of a tool I shipped, was proud of, and never used.
- Then I go say it out loud. GoLab, KCD Italy, WeAreDevelopers World Congress, DevSecOps Day, Incontro DevOps Italia.
- AI Agent Sessions Are a Data Store Nobody Designed
- Introducing Argus: The Code Security Colleague Your Team Doesn't Have
- I Built a Tool I Don't Use
- Go is the primary language: production microservices, two GoLab talks.
- Kubernetes and Flux are the platform backbone: GitOps, with talks at KCD Italy, DevOps Day and Incontro DevOps.
- TypeScript and Next.js for product frontend, and for davideimola.dev.
- DDD, TDD and GitOps are how all of the above stays maintainable. The tests are not optional.
- davideimola.dev for everything I write, build and speak about.
- A monthly digest of it, in your inbox.
