IT Security Engineer (Application / Development Security) — Eindhoven, NL. I build developer-facing tooling: small, sharp, reusable things in the terminal, security guardrails that make the right thing the easy thing, and I ship the whole chain — code, tests, publish, distribute.
Passionate about JavaScript/TypeScript. Simple, to-the-point code. Build it once, let it scale.
📫 LinkedIn · open to DevSecOps / Platform / AppSec conversations
- Sustainable fixes, not patches — fix + control + self-documenting code with clear errors, so the problem can't quietly come back.
- Make complex things simple — the value is in the abstraction, not the cleverness.
- Data first — scanner output, pipeline health, real numbers over opinions.
- Build it once, let it scale — governance tools and shared components, not hand-work per repo.
Everything below is on npm — npx or npm i and go.
Stats auto-generated by scripts/update_stats.py — do not edit by hand.
19,222 npm downloads/month across 14 published tools · ★33 stars
Trusted in production by teams using strapi-health-plugin (Kubernetes health checks for Strapi) and my Next.js ESLint plugins — the bulk of that traffic.
Plus an experimental
@flupkejs/*family (166 packages) — work in progress, see below.
| Package | Monthly downloads | Stars | What it does |
|---|---|---|---|
npm-audit-plus-plus |
1,031 | ★1 | Convert npm audit output to XML for GitLab pipelines |
npm-outdated-junit |
12 | ★1 | Convert npm outdated to JUnit XML for CI |
| Package | Monthly downloads | Stars | What it does |
|---|---|---|---|
eslint-plugin-nextjs-enforce-use-client |
2,376 | ★5 | Enforce use client in Next.js |
eslint-plugin-nextjs-enforce-runtime-edge |
263 | — | Enforce edge runtime for Cloudflare |
@rkristelijn/eslint-plugin-mui |
2,459 | — | Extended custom ESLint rules for MUI |
@flupkejs/* — native drop-in replacements ⚠️ experimental
Work in progress — not yet proved. A vibe-coded exploration that still needs validation (tests, benchmarks, API parity) before it's production-ready. Numbers below are informational, not a maturity claim.
A family of 166 packages — 1,424 downloads/month combined. Native drop-in replacements for popular dependencies (axios, lodash, moment, dotenv, uuid, qs, chalk, ms, ...) with lean ES2020+ implementations. One command via @flupkejs/cli.
- cpm — a C++ code-quality engine (format / lint / test / SAST gate). This is where the "sustainable fix" idea becomes a tool teams can run.
- keur (sneak preview — not yet public) — deterministic security guardrails for AI-generated code, with a self-improving rule loop trained against a proven-tool baseline. The next step beyond cpm.
- glab-tui — k9s for GitLab, in Go.
- the
@flupkejs/*experiment — vibe-coded native drop-in replacements; a learning exercise, honestly labelled work-in-progress (see below).
35+ merged PRs across 18 external projects — I work in other people's codebases too, not just my own. A recurring theme: accessibility (WCAG/a11y) fixes.
Notable projects:
- metabase/metabase — a11y fixes (removed invalid
aria-expanded, enabled zoom). - backstage/backstage — page theme colors fix.
- strapi/documentation — docs fix.
- marktext/marktext — TOC active-heading highlighting, Dutch locale, pre-commit hooks, and an open foldable-headings PR (a top request open since 2020).
- ng-bootstrap/ng-bootstrap & angular-slider/ngx-slider — a11y
aria-labelfixes. - willmendesneto/ngx-skeleton-loader — WCAG 2.1 AA
aria-label. - ROZ-nanobots — a self-healing Linux health daemon. I mentor + contribute here (my son's project): added a macOS port, UPS health check, an SBOM/CVE monitoring module, and the full quality toolchain (CI, hooks, ruff, mypy, semgrep, gitleaks).
- Plus security/vuln fixes and tooling across
learn-json-web-tokens,fullstack-typescript,console-log-json,editorconfig-cli, and more.
A11y and dependency-hygiene fixes to widely-used projects — small, focused, mergeable contributions that make real software better for more people.
TypeScript · Node.js · React/Next.js · Go · C++ · Shell · GitLab CI · Cloudflare · Docker/Kubernetes
Focus: developer experience × security. Terminal-first. Build once, scale.