I build tools that catch the fault before it ships.

I'm Henry. I make security and hardware engineering software: a fuzzing agent that finds memory bugs in C, C++ and Rust, an architecture board that checks every interface, and a wiring planner that warns you before a motor fries a pin.

All three are live and open to try. The board is wired to them, so pick a connector.

See the work Get in touch

Bill of materials

Ref	Part	What it does	Built with	Since
J1	oxfuzz	Finds crashes in C, C++ and Rust code	Rust, 28 crates	June 2026
J2	Schematica	Draws and reviews system architecture	JavaScript, Node, Docker	Sept 2026
J3	Vizio	Plans robot wiring and checks it	React, TypeScript, Vite	Oct 2026

oxfuzz

Find the crash before your users do.

An open-source AI fuzzing agent. Point it at a source folder and it picks the functions worth attacking, writes the harness, runs AFL++, libFuzzer, honggfuzz or syzkaller in a sandbox, and hands back every crash with the input and stack trace that reproduce it.

Nothing runs unreviewed. Generated code builds and runs in a container with no network, and only after you approve it.
One service core behind a desktop app, a CLI and a REST API.
Ships for macOS, Linux and Windows, in English and Chinese. MIT licensed.

Open oxfuzz Source on GitHub

oxfuzz Run screen after a one-minute AFL++ campaign, showing edges covered, crash signals and executions per second — A one-minute AFL++ campaign on the bundled UTF-8 decoder example.

Try it: fuzz a decoder in your browser

This is a toy, written for this page. It mutates a seed input and throws it at the small UTF-8 decoder below until one input makes it read past the end of its buffer. The real oxfuzz finds the same class of bug in real code.

function decode(buf) {
  let i = 0
  while (i < buf.length) {
    const lead = buf[i]
    const more = lead < 0x80 ? 0 : lead >= 0xF0 ? 3
               : lead >= 0xE0 ? 2 : lead >= 0xC0 ? 1 : 0
    if (more > 0 && i + 1 >= buf.length) break   // checks one byte ahead
    for (let k = 1; k <= more; k++) {
      const next = buf[i + k]                      // but reads up to three
      if ((next & 0xC0) !== 0x80) break
    }
    i += more + 1
  }
}

Inputs tried: 0
Branches reached: 0 / 10
Corpus: 1

Seed input: "hello". No crash yet.

Schematica

Draw the system, then check that it fits together.

A browser board for embedded hardware, enterprise networks and the security incidents that cross them. Place controllers, sensors, servers and firewalls, connect their ports, and Schematica checks the interfaces you declared against each other.

Give it a CVE id and it draws the explainer from the published record. Give it an incident log and it replays the attack on a clock.
Exports a design review package, a client report, PNG, SVG, PDF or interactive HTML. Imports KiCad netlists.
No account, no build step. Boards stay in your browser, in English or Chinese.

Open Schematica

Schematica showing the Autonomous Rover example: a battery and regulator feeding a rover microcontroller that connects to a ToF ranger, LiDAR, bumper and drive stepper — The Autonomous Rover example, with three open design-rule findings in the toolbar.

Vizio

Wire the robot on screen before you wire it on the bench.

A wiring planner for hobby robot makers. Pick real boards and parts, connect their real pins and cables, and get plain-language warnings when something would go wrong.

61 parts with real pinouts, from an Arduino Uno to an RDK S100.
Twelve live checks: voltage mismatch, missing common ground, too much current from a board pin, a motor wired straight to GPIO.
Ends in a pin table, a parts list, pin setup code and a share link. Runs entirely in the browser, on a phone too.

Open Vizio

Vizio showing the obstacle-avoiding car example: an Arduino Uno wired to an ultrasonic sensor, an L298N motor driver, two gear motors and a battery pack, with its pin table below — The obstacle-avoiding car example. The badge reads "No problems" because every check passes.

How I work

I ship the whole thing

Each project runs on its own server with HTTPS. Schematica and Vizio release through scripts that health-check the new version and roll back on their own when a check fails. Nothing here is a mock-up.

I assume the input is hostile

oxfuzz runs generated code in a sandbox with no network. Schematica's deploy key can run one command and nothing else.

I write for the person using it

Warnings say what is wrong, why it matters and how to fix it. Schematica and Vizio open with a hands-on tutorial, and all three work in English and Chinese.

I say what it doesn't do

Vizio's checks catch common mistakes and say plainly that they are not a safety guarantee. I would rather a tool be trusted for less than believed for too much.

Looking for someone who builds things like these?

I'm open to roles in security tooling, developer tools and embedded software. The quickest way to judge my work is to open it.

GitHub profile oxfuzz Schematica Vizio