Strip authorization tokens, cookies, API keys and personal data out of HTTP Archive captures before attaching them to bug reports or sharing them for triage. Built to ensure raw browser debugging logs do not leak active session credentials.

Find Python docstrings across a codebase and rewrite them as hash comments at the same indentation level. Built for workflows that prefer comments placed above code blocks rather than docstrings sitting below function and class signatures.

Compute exact probability distributions for complex dice pools including keep highest, keep lowest, advantage and exploding dice. Built with rational fraction arithmetic instead of simulation so table game mechanics can be evaluated without random seed variance.

Scan Markdown documentation trees for broken relative file paths and broken header fragment links. Built to catch documentation rot where renaming a header breaks deep links into the page without failing standard build steps.

Report invisible, reordering and confusable characters in text files to ensure text displayed on screen matches underlying content. Built to detect homoglyphs, zero width spaces and direction overrides before files are processed or executed.

Trace HTTP redirect chains hop by hop and flag protocol downgrades, infinite loops and cross domain jumps. Built for web forensics, security audits and link hygiene checks where understanding intermediate hops prevents phishing and open redirect vulnerabilities.

Scans source code against reference environment files to detect undocumented reads, unused configuration keys and exposed environment files before deployment. Built to catch missing configuration variables before services fail at import time.

Reports files that git continues to track even after matching a gitignore rule. Built to uncover hidden tracked secrets, build artifacts and editor junk that linger in repositories despite exclusion patterns.

C++20 port of NTFS MFT parser that reads raw $MFT dumps and extracts standard information and file name timestamps with high performance memory mapping. Built for fast digital forensics analysis with byte-identical output to Python tooling.

Checks crontab schedule files for syntax errors, reversed ranges, impossible calendar dates and conflicting schedule restrictions before deployment. Built to catch silent failures and misconfigured automation jobs before they quietly drop or misfire.

Audits Model Context Protocol configuration files for risky settings, unpinned packages and unauthorized shell wrappers. Built to verify agent permissions before granting local execution access.

Investigates Windows memory images using read-only Volatility plugins driven by a language model, with every claim verified against raw tool output logs. Built to combine forensic analysis with automated verification.

Recovers deleted rows and leftover text fragments directly from SQLite database files without relying on database engine recovery functions. Built for low-level data recovery and forensic artifact extraction.

Scans GitHub Actions workflow files for mutable action tags, unpinned container digests and excessive token permissions. Built to harden CI/CD pipelines against supply chain compromise.

Personal profile repository hosting GitHub configuration entry points, contribution widgets and profile metadata. Built as the central hub for public repository management.

Reads Windows event logs straight out of their binary form, checks structural integrity, parses every record, & runs detection rules without needing any heavy framework or live Windows host. Built to inspect forensic evidence safely using only the Python standard library.

Correlates network packet triage outputs with host authentication logs by IP address to unify scattered forensic artifacts into a single chronological view. Built to connect what happened on the wire with what happened on the login prompt.

A high-performance network connection anomaly detector & triage tool that audits listening sockets & flags suspicious or unexpected port activity. Built in C++ to provide fast telemetry analysis without heavy external dependencies.

An AES-256 file encryptor that asks for two separate passwords before it will open anything, so a single leaked secret is not enough to walk away with the contents. Built to understand key derivation & why one factor is rarely the right number.

A secure AES-256 vault in Python where the key handling is kept simple enough to read end to end & audit. The point was a vault I could explain line by line rather than one that leaned on a library for everything.

Reads Linux authentication logs & rebuilds the sequence of events behind them: which addresses tried, which one succeeded, & what ran afterwards. Reconstructing the story is usually slower than noticing the alert, so this automates the slow part.

Watches active network connections in real time, resolves the process behind each one, & writes a structured JSON event the first time a connection appears. Small enough to leave running on a laptop.

A lightweight intrusion detection system for Linux that analyses live network traffic, pairing anomaly detection with behavioural rules so it can flag what looks wrong even when it does not match a known signature.

An SSH deception system built on Python & Paramiko that safely captures attacker credentials, commands & behaviour. Written for SOC & DFIR labs that want to study real attack techniques without putting production systems anywhere near the blast radius.

Puts a language model behind the shell prompt of an SSH honeypot, so an attacker gets a plausible back & forth instead of a scripted response, while every command & reply is recorded for later analysis.

Parses a PCAP file & writes a human-readable report of what happened on the wire, aimed at the people who need the conclusion rather than four thousand lines of packet detail.

An attempt at parsing MFT records directly out of an NTFS volume, which is where file creation, modification & deletion timestamps actually live & where a lot of timeline work begins.

A password brute forcer for AesCrypt & pyAesCrypt containers. The interesting part was never the speed, it was learning what makes a passphrase guessable & how much that costs an attacker per guess.

Builds a large base64 encoded key out of two large primes, with control over the seed needed to regenerate it. A hands-on look at why the randomness underneath a key matters as much as its length.

A proof of concept that slowly reads & corrupts files on a system. Useful for studying how corruption spreads, what it looks like at the file system level, & how detection might catch it early.

Scans system, authentication & application logs for the shapes that usually mean something is wrong: brute-force runs, error spikes, & behaviour that sits outside the normal pattern for a host. It reads the files it is pointed at & needs nothing installed first, so it runs on the machine where the logs already are.

Hashes every file under a directory into a JSON manifest, then re-checks that tree later & reports exactly what was modified, added, removed or merely touched. Built for config folders & web roots, where the first useful question after a suspected change is which file moved rather than whether one did.

Reads an agent skill folder or an MCP configuration tree & reports the capability grants worth arguing about: shell & destructive commands, network calls, credential reads, writes outside the workspace, unpinned launch commands, & text that tells the agent to disregard its instructions. It answers what an agent could do if nobody checked.

Inventories what AI coding agents leave on a machine: full session transcripts, prompt history, cached indexes, & in several cases the API keys they authenticate with. That state survives an uninstall & gets swept into backups, so the tool exists to answer what is still sitting on the disk after the agent is gone.

Reads a packet capture & prints a short report: who talked to whom, over which protocols, which names were asked for, & the handful of things worth a second look. It is aimed at the first ten minutes with a capture you did not take yourself, before opening a full protocol analyser on it.

Multi-account roleplay chat application featuring both a terminal interface and a web backend for interacting with language models. Built to manage chat histories, memory banks, persona choices, and administrative controls across local deployments.

A terminal roleplay engine for the Gemini API with folder-per-character personas, memory banks, group chats & free-tier budget tracking, so a long session does not quietly run into a quota wall.

A retrieval augmented generation pipeline with nothing hidden behind a framework: chunking, embeddings, cosine similarity search & prompt assembly each sit behind a small swappable interface, so you can see where retrieval quality is actually lost.

Log-based behavioural anomaly detection on the HDFS dataset, built for an AI tools & techniques module. Decision tree classifiers compared against each other with precision, recall & F1 as the yardstick.

Trains a model on a set of images & learns to sort them into classes, written as an exercise in the full training loop rather than a single library call: loading, splitting, fitting & checking.

Predicts housing prices from a CSV using pandas, cleaning & shaping the data first. A useful reminder that most of the work in a model is the part that happens before the modelling.

Converts Ren'Py visual novels into the asset formats & scripting language VNDS expects, which is how a desktop game ends up playable on a DS flash card. Written because doing it by hand, title by title, stopped being fun about two games in.

Firmware & detection logic for a device that attaches under a seat & looks for belongings left behind. Built with a team as a hardware project, from the sensor choice through to how the alert reaches staff.

A small HTTP server written in Python to see what a framework hides: request parsing, routing, status codes & response headers, all by hand.

Collects posts from a web endpoint that offers no API, then displays them in a readable list. Written for a site where checking for updates by hand was the only other option.

Code from a school project to build an integrated development environment, covering the editor side of the problem rather than the language side.

A C# group project from the programming module, built around object-oriented design & a class structure the whole team could work against without stepping on each other.

A command line diary that stores entries on disk, with writing, reading & listing handled through a simple menu. One of the first programs I wrote that kept data between runs.

Hangman in the terminal, used as an excuse to practise class design & to keep game state separate from the code that draws it.

Loads a list of questions from a text file & quizzes the user on them, keeping score along the way. A small exercise in classes & reading structured input.

Works through a maze using loops & grid traversal, written as a first pass at search logic before reaching for a proper algorithm.

Reads a CSV of streamer data & arranges it into a readable summary, which is mostly an exercise in sorting & shaping rows without losing any.

Uses fuzzy matching to search a CSV of films, so a slightly misspelled title still finds the right one. A gentle introduction to string similarity & why exact matching is often the wrong tool.

Takes informal text & swaps it into a formal register using a CSV dictionary of replacements. Small, but the first time I saw a lookup table do the work of a paragraph of code.

A command line farming simulator with crops, days & money. Small but complete, & the first program I wrote where the game loop itself was the interesting problem.

A cooking recipe website built with hand-written HTML & CSS for a term project, laid out before I knew what a framework was.

A small hand-written HTML site, kept around as a marker of where the web work started.