Phil Turnbull
Principal Application Security Engineer
Boston, Massachusetts, United States
Summary
🤩
Rockstar🎓
Top SchoolPhil Turnbull is a Principal Application Security Engineer in Boston with 11 years of hands-on experience hardening large-scale software and shipping developer-first security tools. He has led security teams and programs at GitHub and CarGurus, built distributed fuzzing and static-analysis infrastructure, and scaled bug bounty and security champions initiatives across engineering orgs. Phil’s background blends deep C/C++ and Rust expertise—demonstrated by contributions to high-profile open-source projects like rust-clippy, tree-sitter and cmark—with production-grade tooling built in TypeScript, Python and OCaml. He’s as comfortable writing PoC exploits and live-patch updates as he is designing rule-generation pipelines, making him a pragmatic bridge between research and engineering. An unexpected thread through his career is a sustained focus on automating quality and robustness (libFuzzer integrations, fuzz harnesses and static rule automation) to reduce whole-org risk.
11 years of coding experience
16 years of employment as a software developer
Master of Engineering - MEng Computer Systems Engineering, Master of Engineering - MEng Computer Systems Engineering at The University of Manchester
Stackoverflow
1reputation
0reached
0answers
0questions
Github Skills (20)
parserator10
debugging10
debug10
programming-language10
parser10
testing10
memory-management10
c1110
c1710
code-analysis10
parsing10
linting10
fuzzing10
rust10
text-parsing10
Programming languages (12)
Github contributions (5)
tree-sitter/tree-sitter
Jun 2017 - Oct 2019
An incremental parsing system for programming tools
Role in this project:
Back-end Developer & QA Engineer
Back-end Developer & QA EngineerContributions:46 commits, 13 PRs, 18 pushes in 2 years 4 months
Contributions summary:Phil primarily focused on improving the robustness and reliability of the `tree-sitter` parsing system. Their work involved fixing bugs related to state index handling, memory management, and out-of-bound reads within the parsing logic. They also implemented tests, including a new test case to identify vulnerabilities in the UTF16 handling. Further contributions include adding libFuzzer support and addressing compiler warnings.
incrementaltree-sitterincremental-parsingrustprogramming-tools
rust-lang/rust-clippy
Nov 2016 - Aug 2018
A bunch of lints to catch common mistakes and improve your Rust code. Book: https://doc.rust-lang.org/clippy/
Role in this project:Back-end Developer
Back-end DeveloperContributions:3 PRs, 4 comments in 1 year 9 months
Contributions summary:Phil contributed to the Clippy linter for the Rust programming language by implementing and improving lint checks. They added new lints to catch common mistakes, such as using `.extend(s.chars())` and `*&` or `*&mut`, and provided suggestions for more idiomatic code. The user also refactored existing code and improved the clarity and efficiency of the linting rules. Their work focused on enhancing code quality and catching potential issues in Rust projects.
linterlintrustlangmistakes
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.