Technical writeups covering detection engineering, Linux hardening, CTI enrichment, and security tooling.
After NLTK fixed a regex DoS in its XML corpus reader, the loop around the regex was still quadratic: every 1 KiB read rescanned the entire accumulated buffer. An 8 MiB malformed XML file burned about 48 CPU-seconds through a public API. I found it while re-testing the earlier fix.
Read writeupNLTK’s package downloader extracted archives into shared namespace folders without checking file ownership, and validated integrity only after extraction. A malicious package could silently overwrite another package’s trusted models. I reported it, and the fix was merged upstream.
Read writeupSiteGuard is a Flask + SQLite website security monitor: 17 security checks, 30-minute uptime monitoring, A–F grades, plain-language fix guidance, scan diffs, and dark mode. Built for a one-person VAPT freelancer — zero budget, runs anywhere.
Read writeupNetPulse is a zero-dependency Go network diagnostic HUD for Linux. A Bubble Tea TUI aggregates gateway latency, a multi-cluster DNS latency matrix, interface throughput, and backbone telemetry into one keyboard-driven tactical dashboard.
Read writeupTechnical writeup for a Blue Team CTI pipeline that ingests open-source IOCs, deduplicates and scores them, enriches high-confidence indicators, and exports live Wazuh CDB detection lists.
Read writeupTechnical walkthrough covering the remediation of 100+ misconfigurations on a minimalist Arch Linux endpoint to achieve an 83% CIS Benchmark score. Demonstrates a defense-in-depth methodology, shifting from a vulnerable baseline to a production-hardened posture via layered kernel, filesystem, and identity-level controls.
Read writeupPeelr is a stdlib-only Go tool for JavaScript recon and triage. It analyzes remote or local .js files, highlights secrets, endpoints, risky sinks, and paths, then presents results through a CLI, web UI, and scan history.