Detection engineering · LOQED Insider-risk analytics on endpoint telemetry 2026
- Problem
- Endpoint telemetry already recorded what people did on company machines, but nothing turned it into a risk view that could survive scrutiny — and a wrong score can cost someone their job.
- Approach
- An 11-stage pipeline, read-only against production, that builds per-person baselines and deviations in plain SQL. A language model only narrates and labels; it never produces a score. A local overlay fills gaps in a classification catalogue owned by another team, without modifying it.
- Outcome
- Exposed a metric that looked like 20% personal browsing but was almost entirely legitimate work tools. Every signal now ships with its definition and limits, and none feeds a decision until it is validated against a hand-checked calibration set.
- Stack
- PythonDuckDBSQL ServerDjangoReact
Threat intelligence · LOQED External exposure monitoring 2026
- Problem
- Endpoint monitoring sees inside the machines. Clients also needed to know what was leaking outside: credentials in infostealer logs, ransomware leak sites, lookalike domains.
- Approach
- A dependency-free Python service that aggregates existing intelligence feeds into one severity-ranked view per client, with no active crawling of Tor and no third-party packages to audit.
- Outcome
- A working prototype that answers one question at a glance: is something about this client showing up outside, and how bad is it?
- Stack
- Python stdlibSQLiteThreat intel feeds
Open source · Security education Breachle 2026
- Problem
- Security awareness training is something people sit through, not something they come back to.
- Approach
- Four daily puzzle games: guess the CVE from its attributes, group alerts into attack types, judge phishing emails, and spot the malware name. Fully client-side, with every day's puzzle derived deterministically from the date.
- Outcome
- Live at breachle.app, with streaks, an archive and share cards. The source is public.
- Stack
- SvelteKitSvelte 5TypeScriptCloudflare Pages
Tooling · Personal Supply-chain gate for AI coding agents 2026
- Problem
- AI coding agents install third-party skills, hooks and MCP servers that run with the developer's permissions. Most setups install whatever a blog post recommends.
- Approach
- Read-only discovery separated from installation. Candidates are quarantined, checked for provenance, license and suspicious structure, and never executed during review. Only exact allowlisted sources install automatically; everything else needs explicit approval for a specific commit.
- Outcome
- A single shared skill store for three different agents, where every installed capability has a recorded source, commit and hash.
- Stack
- PythonClaude CodeCodex
Infrastructure · Personal Self-hosted offensive security lab 2026
- Problem
- Testing web applications needs a reproducible environment that isn't a laptop VM that breaks after every update.
- Approach
- Kali Linux on a Hyper-V host with a scripted display and RDP fix, Burp Suite that starts headless with its REST API and extensions loaded, and access locked to a single workstation by firewall rules.
- Outcome
- Rebuilding the lab after a failure takes minutes. The display issue became the first write-up on this site.
- Stack
- Kali LinuxHyper-VBurp SuitesystemdBash
