Things I build when the tool I need doesn't exist yet. The platform, the CLIs, the homelab glue and the odd bit of hardware, all in one place.
All-in-one cybersecurity environment for CISOs and SOC analysts. One place to monitor, investigate and report, instead of ten disconnected tabs.
An atlas of every « -punk » out there: cyber, solar, diesel, bio, retrofuturism and the rest. What if our present were just one plausible future among many?
A supply-chain scanner that resolves the whole dependency graph, then flags malicious install code, typosquats and shady provenance across your packages and your OS. Repo-reputation scoring, CVE intel, no telemetry.
The blue-team swiss-army knife: triage logs, carve PDFs and run email checks from a single CLI, so the boring parts of an investigation take seconds.
Runtime security for k3s clusters. Watches what is actually running rather than what the manifests promised, and says so from one CLI.
Instead of injecting JS chunks into a page, this CLI downloads them locally for offline analysis: reversing, auditing, source recovery of webpack / Next.js bundles.
Static analysis for Android and iOS packages (.apk, .aab, .xapk, .ipa). Unpacks the archive, runs fifteen analyzers, and reports findings with a weighted score.
An offline-first scanner for ML model artifacts (safetensors, GGUF, PyTorch pickle). Answers the two questions worth asking about a model you just downloaded.
A read-only macOS hardening and security audit scanner. Tells you how exposed the laptop is without touching a single setting itself.
Static security scanner for MCP servers. New protocol, same old injection surface, so it got a scanner before it got a CVE list.
The keyboard-driven front end to mlab.sh: scan a domain, look up an IP, analyse a file, inspect a certificate, search the CVE catalogue. Terminal output when you are reading, raw JSON when you are scripting.
A rule-based detection engine for parsed logs. Write the logic as a readable expression, it compiles that into a condition tree and evaluates it, small enough to embed in a SIEM pipeline.
Audits a UniFi console for segmentation, firewall, Wi-Fi and exposure issues, snapshots it, and diffs what changed since last time.
Audits a MikroTik router over the RouterOS REST API, and matches CVEs to the exact installed version rather than to the product name.
Read-only Cloudflare account audit over the v4 API: DNS, edge posture, TLS, Workers, Zero Trust, logging and IAM, with graded findings and one exit code.
Audits a Proxmox VE cluster for access control, firewall, guest isolation, backup and patch issues, then diffs the next run against it.
Audits a Scaleway account for IAM weaknesses, internet exposure, plaintext credentials and published CVEs. Every request is a GET.
A GitHub Action that scans your lockfiles for known CVEs on every push. It finds them itself, checks each dependency against OSV and OSS Index, and fails the build on the severity threshold you pick.
The same lockfile scan, in the editor. Nothing leaves the machine until you agree once, results are cached per file content, and an unchanged lockfile is never uploaded twice.
An n8n community node that drops domain, IP, file and crypto scans, CVE lookups and threat-actor intel straight into a workflow, so automation reaches the same data as the CLI.
macOS, kept lean. I got tired of cleaning it by hand, so I wrote a CLI that sweeps the caches, logs and cruft for me on a schedule.
A CLI to manage a list of SSH hosts: list, create, edit, delete and connect through an interactive terminal interface. Hop between hosts without memorising a single IP.
A TUI password manager that lives in the terminal and holds the keys. No browser extension, no cloud, just a fast interface where the secrets stay.
Reports how far behind upstream your Nix fetchFromGitHub pins have drifted, so a flake update stops being archaeology.
A custom Plex metadata provider for YouTube channels archived with TubeSync. Reads everything out of the filename, pulls thumbnails straight off the public CDN, and needs no API key to do it.
Self-hosted file sharing where every link is password-protected, expires on a timer and can cap its own download count. Drag and drop on the admin side, a ZIP on the way out.
Deluge with the Python taken out: a BitTorrent daemon and Web UI rewritten in Rust on top of libtorrent. Same DelugeRPC wire protocol and same config files, so existing clients and installs keep working. Linux only.