Security tools
Tools for gaps I kept hitting in pentests, cloud reviews and alert triage. Each builds on open-source parts, credited in its repo, and is rebuilt on lab and synthetic data before it goes public.
Last updated 27 Sept 2026
wsprobe
A WebSocket pentesting harness, a Python CLI and a Burp extension, for the traffic HTTP tools stop reading after the upgrade.
Lantern
My hackathon SIEM assistant (second of 33 teams), rebuilt and extended: read-only AI investigation over Wazuh and alerts grouped into incidents, with Wazuh 5 and an analyst case console next.
Winnow
AI-assisted secure SDLC: threat-models a codebase, reviews code alongside the scanners, maps the APIs that touch sensitive data, and confirms findings with a check outside the model.
Works now: SARIF ingest from existing scanners, a static API inventory tagged for auth and PII, and a coverage gate against the threat model. Next: the AI-assisted review pass.
Horizon
A cloud security platform for AWS and Kubernetes that joins posture, identity and runtime, and checks what is reachable from outside against what the inventory says exists.
Designed: an asset and identity graph on Cartography, drift between syncs, seed detections and the AWS logging groundwork. Next: the first AWS collectors.
ward
Data-loss prevention for small teams across hosts, network and SaaS: it finds PII and secrets where they sit and reports each exit without copying the content.
Works now: the classification core, finding PII and secrets in a synthetic corpus. Next: agentless discovery across SaaS and cloud storage.
mobkit
One command line over adb, Frida, objection and drozer, with a scripted Android and iOS lab setup.
Works now: scripted Android, iOS, macOS and Windows lab setups, a static-analysis image, and one CLI over them. Next: the posts that walk through each setup.