LogLens
Offline auth-log analysis with parser coverage, time-separated detection episodes, and Markdown/JSON reports. Unsupported input stays visible; a finding is a triage signal.
Systems programming · Product security · Supply chains
stacknil
Systems tools.
Evidence you can inspect.
I build C++ and Python tools for Linux authentication logs, saved process evidence, repository checks, and dependency review.
01 / Code
Selected projects
Released versions link to tags. Source and tests on main may include later work.
telemetry-lab
Five local, file-based demos covering event windows, rule deduplication, and investigations. Schemas and run manifests connect outputs to inputs. This is a lab, not a SIEM.
repo-sentinel-lite
Repository scans with redacted output, reviewed baselines, and changed-file checks for pre-commit workflows. Heuristic findings support review; a clean scan cannot prove secrets are absent.
scientific-computing-toolkit
The flagship SBOM/dependency diff tool produces JSON, Markdown, and SARIF policy-review artifacts. Optional provenance is context, not a vulnerability or package-safety verdict.
systems-foundations
Four Linux evidence mini-labs for saved authentication, socket, permission, and process state. A process-diff adapter emits JSONL for telemetry-lab; it does not collect live telemetry.
sec-writeups-public
Security pattern cards drawn from sanitized, authorized lab notes. Python checks enforce taxonomy, source references, and publication conventions.
02 / Decisions & evidence
Selected engineering cases
Saved process evidence → telemetry aggregation
The case study reports seven observations, one observation-time window, and zero alerts using two pinned implementations. The timestamp describes a snapshot comparison, not when each change occurred. This exercises ingestion and aggregation, not detection efficacy.
Public: pinned code, synthetic fixtures, and producer goldens. Full execution receipts remain privately retained.
Keep uncertainty in the report
Classify unsupported input and expose coverage alongside findings, so a parser gap cannot silently become evidence of absence.
Read the parser caseExplain a dependency warning
Trace dependency changes into policy evidence while keeping risk heuristics and optional provenance separate from package-safety claims.
Read the SBOM case03 / Notes from the work
Technical writing
- Evidence pipeline contractsEvent, finding, summary, and manifest schemas across five demos.
- Repository hygiene in its own development workflowBaseline review, redaction, and the limits of heuristic scanning.
- Linux systems notesText processing, saved system information, and evidence handling.
Reusable security patterns
Start with parser uncertainty, baseline governance, or SBOM policy warnings. The full library includes the supporting sources.
04 / Get in touch
Code, questions, and focused review
For a bug or technical question, open an issue in the relevant repository with a command and a sanitized example.