Secure development with AI
Code with Claude Code or Copilot without opening security holes in your codebase.
I am Daniel Alfocea, known for years as cr0hn
Training and monthly advisory in secure development and AI security. Twenty years in the field, including Santander (Principal Engineer, AI) and BBVA (Cybersecurity Tech Lead).
I work with teams that already code with AI and want to keep doing it without leaving doors open. I train your team on its own code, and if the system is already running, I go in to find where it breaks before someone else does.
One-day workshop, on site or online, 5 to 8 hours depending on the team, or a full six-week programme.
They have trusted my work
RootedCON, with Jesús Cuadrado: API security 
RootedCON, with Jesús Cuadrado: API security 
RootedCON, with Jesús Cuadrado: API security 
RootedCON, with Jesús Cuadrado: API security 
RootedCON 2026: “When MCP goes Wrong”
Where to start with your team
For your team
Training
One-day workshops and six-week programmes on secure development, secure AI development and AI productivity. On your own code.
See the training →For you
Mentoring
Architecture, security, teams, career and using AI: how I make technology decisions when I do not have all the information.
See the mentoring →So you know who you are talking to
I started by breaking systems. Then I wrote tools so I would not have to break them by hand every time. Some, like GoLismero, Plecost and Dockerscan, are used by security teams all over the world. Others are used by teams that will never know my name.
Once I found the medical records of millions of people sitting open on the internet. The owner believed it was closed. I wrote to them. They avoided a fine of the kind that hurts. They did not thank me, and that is not why I did it.
A process that took eight hours dropped to a tenth of a second. Same machine, same code. I only looked at where the time went. It is what I always do: find where time goes, where it will break under pressure, and where someone will get in.
I gave a talk and several companies checked their systems the next day. Some found open doors that had been there for months. I want the same to happen to you, just before anyone gets in.
I have been inside Banco Santander, BBVA, much of Spain's IBEX 35, and companies in the US, India and the UK. Not as a visitor: inside, with the system running. At Santander I was Principal Engineer in the AI department while the area was being set up. The bank has 185,000 employees and OpenAI as a partner; my job was making it work on the inside. At BBVA I was Cybersecurity Tech Lead. At 42Crunch, in the UK, I was responsible for one of its API security products.
I founded Navaja Negra and OWASP Madrid because Spain needed places to talk about security without the posture. I have presented research at RSA Conference and OWASP AppSec EU, and I am a regular speaker at RootedCON. Spain's National Cybersecurity Institute (INCIBE) has asked me to judge its competitions several times. With Alfonso Muñoz I wrote Secure MCP: A practical guide for developers, software architects and tech leads.
Now I work on my own. I train teams and step in when the problem will not die in another meeting. And every day I send one email about one thing I saw break, so it does not break on you.
The long version is on About.
Not the right time yet?
Join the newsletter. Every day I send you one thing I saw break, and when your team is ready you will already know how I work.