GitHub

LunaSec was a venture-backed open-source security company I founded and ran as CEO, raising $1.7M and building a team of six. It began as a Y Combinator company (S19) and grew a family of products around one belief: that the security tooling most teams actually need should be open source and self-hostable, not locked behind an enterprise sales motion.

The flagship is LunaTrace — an open-source software-composition-analysis tool that watches a codebase and its dependency tree for known vulnerabilities. It installs as a GitHub App, integrates directly with pull requests, and surfaces newly disclosed CVEs before vulnerable code merges to production, positioned as a free alternative to Dependabot or Snyk that runs either as hosted SaaS or entirely on your own infrastructure. The monorepo is a TypeScript-and-Go codebase with roughly 3,400 commits and about 1.5k GitHub stars, publishing artifacts to npm, DockerHub, and GitHub releases.

The company shipped more than one product line from zero. LunaDefend was a tokenization-based data-protection suite aimed at the compliance surface — SOC 2, GDPR, PCI-DSS — that swaps sensitive fields out of an application’s own datastore. Building products across supply-chain security, data security, and a Heroku-like AWS deployment layer meant designing each from first principles: threat model, data flows, and a clean open-core split between what ships free and what a company pays for.

LunaSec’s most visible moment came through its security blog, which is where the team broke the log4j news in December 2021 and coined the name “Log4Shell” — the response that shaped how the industry framed the single most consequential vulnerability of that era. The company wound down in 2024; its code and advisories remain public.