Matthew Hunter

Selected work

Production systems I designed, built, and operate -- an engineering portfolio, not side projects.

• memstoreopen source

  Persistent memory for AI coding agents, ~28k lines of Go in daily production use. Built secure-by-design against a written threat model: namespace isolation, parameterized queries, input sanitization.

  Stack: Go, PostgreSQL/pgvector, SQLite, MCP; hybrid full-text + vector search

• maildanceropen source

  Mail server suite built ground-up on privilege separation: internet-facing daemons parse untrusted protocol input with no filesystem or credential access, brokered by a session manager, with the boundaries enforced by CI lint rules.

  Stack: Go, SMTP/POP3/IMAP, gRPC; argon2 auth, keyring key custody

• oidclientopen source

  Relying-party module for the self-hosted OIDC identity provider I run for SSO across my production sites -- the OAuth2/OIDC attack surface worked from the implementer's side.

  Stack: Go, OIDC, OAuth2

• heraldopen source

  AI-curated RSS reader with defense in depth: a tool-less screening model filters prompt injection out of untrusted feed content before any tool-enabled model sees it.

  Stack: Go, SQLite, Ollama, MCP

• oldschoolgamers.orglive

  Full-stack site I architected, built, and run solo: custom CMS, Go backend, full-text and vector search, containerized deploy.

  Stack: Go, PostgreSQL, Docker; full-text and vector search; custom CMS

• speculativefiction.orglive

  Book discovery platform I designed, built, and run: Go service with a Wikidata enrichment pipeline and hybrid search that fuses full-text and vector results.

  Stack: Go, PostgreSQL/pgvector, Docker; hybrid FTS + vector search with RRF fusion