Security & Supply Chain

A multi-LLM agent stack where every tool call passes through RBAC, rate limits, injection scanning, and human approval before execution.

A hands-on framework for turning LLMs into private security agents, with RAG, hybrid context, few-shot reasoning, and prompt-injection guardrails built into the curriculum.

A deep dive into how sybrew/pro-mime-types rebuilds WordPress’s MIME rules, scores file risk, and keeps multisite upload policy sane across changing environments.

A read-only Go CLI with a TUI twin, a uniform scanner interface, and a concurrent execution model that makes cloud hygiene feel local, fast, and safe.

A Bun-powered TypeScript tool that turns swallowed exceptions, weak logging, and brittle string matching into reliability policy.

Instead of stopping at a single bug, this repo tries to link findings into a stronger attack chain, turning exploit composition into a repeatable workflow.

A tiny repository for binaries, MDM profiles, and anti-tamper rules reveals how enterprise security software gets installed, trusted, and kept running across Windows, macOS, and Linux.

A cloud-native security layer for Envoy that blends Rust, Lua, GitOps, and sequence-aware inspection into one proxy-side defense system.

A Node gateway, Redis, a Python worker, and a risk-score layer turn cloud auditing into a distributed system you can test, scale, and reason about.

A layered Express 5 stack with Arcjet, Drizzle, Zod, and Docker defaults that turns user role, bot detection, and rate limiting into part of the request flow.

A two-node lab that starts with default alerts and ends with tuned rules, real-time file integrity monitoring, and the log-forensics mistakes every security engineer eventually has to make.

A self-hosted threat-intel stack that watches websites, RSS, APIs, and .onion sources, extracts IOCs, and uses content-plus-context hashing to cut alert fatigue before it starts.

A deep dive into the out-of-window SNI injection trick, the raw-socket plumbing behind it, and why the project is more about TCP state than TLS itself.

A compact Linux packet engine that forges ICMP Time Exceeded replies, injects MPLS labels, and makes a single host look like a whole provider backbone.

A compact shell orchestrator that chains subdomain discovery, content hunting, and vulnerability scanning into a file-driven bug bounty pipeline, with quick mode and authenticated testing built in.

A tiny Scapy proof of concept, a forged inner header, and a kernel validation path that turns a routine network error into a crash.

This Terraform module encodes least privilege, API enablement, and keyless trust into one repeatable GCP handoff.

A deep dive into the JFrog extension that checks remote packages against live malware intel and blocks suspicious downloads before they land.

How the open-source CRM Twenty isolated its GitHub Actions to solve the "pwn-request" problem, creating a zero-trust DMZ for automated code review.

How a Rust-based security daemon protects developers from poisoned AI dependencies, credential exfiltration, and runaway API billing.

How a network-level 'Secret Proxy' and egress-secured sandboxes are solving the AI agent security dilemma.

A masterclass in "unzip-and-run" architecture, securing the chaotic world of LLM webhooks with nothing but raw PHP and a MySQL socket.

It turns source code into a Neo4j-backed attack map, then uses reachability, centrality, and agentic review to find the code paths that matter most.

A centralized Python gateway that scrubs sensitive input, blocks risky responses, encrypts audit trails, and gives enterprises one place to govern every LLM request.

A close look at a student management backend that uses permissions, scoped querysets, serializer validation, and signals to turn RBAC into a system design pattern.

A cleanly separated .NET banking system that turns MSTest, NUnit, xUnit, and formal test documentation into one connected training ground.

How a Python security script turns face recognition into active defense, encrypting files, swapping in fake data, and giving the owner a remote kill switch.

A full-stack email scanner that pairs TF-IDF logistic regression with frontend heuristics, then wraps the whole thing in a cyber-terminal interface that explains risk instead of just naming it.

A modular Python framework for probing LLM apps through APIs and browser UIs, then judging responses with a fail-first rule that treats any leak as a broken guardrail.

A deep dive into manual packet parsing, TLS SNI extraction, and a fast-path architecture that keeps stateful inspection local, parallel, and surprisingly readable.

A cyber range for authentication security that makes lockouts, CAPTCHA bypasses, and leaked-password checks visible in real time.

A modular defense intelligence framework that fuses RSS news, deepfake detection, acoustic reconnaissance, and a structured military knowledge base into one triage pipeline.

A Spring Boot and React health-record system built around patient ownership, audit trails, and role-based access instead of a static provider database.

A clean full-stack reference for cookie-based sessions, email OTP verification, and password resets that behave like a real application, not a classroom exercise.

A compact Node.js bridge that hides ABI complexity, signs owner transactions on the server, and exposes an Ethereum voting contract as a conventional API.

A look at the security plumbing, cross-origin glue, and defensive data model behind a full-stack finance app that behaves more like production software than a hobby project.

A real-time security lab for cloud workloads that vanish before traditional tools can finish an audit. It tags short-lived resources early, correlates noisy alerts into incidents, and measures its own precision against synthetic ground truth.

Under the hood of a student admin system that treats refresh tokens, role gates, and audit logs like enterprise infrastructure, while keeping the frontend brutally simple.

A Python steganography pipeline that asks you to speak the cover text, counts the silence, and hides encrypted bits where the waveform gives you room.

A deep dive into the locking, idempotency, MPIN checks, and webhook simulation that make this wallet stack read like a production-finance blueprint.

A room-based, browser-native E2EE chat built with Next.js and Socket.io, where the UI teaches you how a message becomes unreadable before it ever leaves your browser.

A phishing detector that reads the URL, looks at the page, and deliberately trusts the messier clue more when the two disagree.

A privacy-first upload-to-spool system that treats the browser, the shop PC, and the file system as temporary, unsafe surfaces.

A deep dive into a privacy-first pentesting assistant that uses deterministic intent routing, live CVE aggregation, and model auditing to turn a chatbot into a security workflow.

A compact Win32 proof of concept that captures keystrokes, hides its console, and moves logs through PowerShell, Base64 layering, and a companion decryptor.

An AI-driven security framework that reads responses, chooses the next test, and turns reconnaissance into a conversational workflow.

A one-file GitHub repo hides a Base64-encoded URL, but the real story is how a harmless-looking challenge can steer curiosity toward an external delivery gate.

A Rust overlay that keeps headers, JavaScript, time zone, and proxy behavior in one believable profile instead of treating spoofing as a single switch.