An AES-256 file encryptor that asks for two separate passwords before it will open anything, so a single leaked secret is not enough to walk away with the contents. Built to understand key derivation & why one factor is rarely the right number.

A secure AES-256 vault in Python where the key handling is kept simple enough to read end to end & audit. The point was a vault I could explain line by line rather than one that leaned on a library for everything.

Reads Linux authentication logs & rebuilds the sequence of events behind them: which addresses tried, which one succeeded, & what ran afterwards. Reconstructing the story is usually slower than noticing the alert, so this automates the slow part.

Watches active network connections in real time, resolves the process behind each one, & writes a structured JSON event the first time a connection appears. Small enough to leave running on a laptop.

A lightweight intrusion detection system for Linux that analyses live network traffic, pairing anomaly detection with behavioural rules so it can flag what looks wrong even when it does not match a known signature.

An SSH deception system built on Python & Paramiko that safely captures attacker credentials, commands & behaviour. Written for SOC & DFIR labs that want to study real attack techniques without putting production systems anywhere near the blast radius.

Puts a language model behind the shell prompt of an SSH honeypot, so an attacker gets a plausible back & forth instead of a scripted response, while every command & reply is recorded for later analysis.

Parses a PCAP file & writes a human-readable report of what happened on the wire, aimed at the people who need the conclusion rather than four thousand lines of packet detail.

An attempt at parsing MFT records directly out of an NTFS volume, which is where file creation, modification & deletion timestamps actually live & where a lot of timeline work begins.

A password brute forcer for AesCrypt & pyAesCrypt containers. The interesting part was never the speed, it was learning what makes a passphrase guessable & how much that costs an attacker per guess.

Builds a large base64 encoded key out of two large primes, with control over the seed needed to regenerate it. A hands-on look at why the randomness underneath a key matters as much as its length.

A proof of concept that slowly reads & corrupts files on a system. Useful for studying how corruption spreads, what it looks like at the file system level, & how detection might catch it early.

Scans system, authentication & application logs for the shapes that usually mean something is wrong: brute-force runs, error spikes, & behaviour that sits outside the normal pattern for a host. It reads the files it is pointed at & needs nothing installed first, so it runs on the machine where the logs already are.

Hashes every file under a directory into a JSON manifest, then re-checks that tree later & reports exactly what was modified, added, removed or merely touched. Built for config folders & web roots, where the first useful question after a suspected change is which file moved rather than whether one did.

Reads an agent skill folder or an MCP configuration tree & reports the capability grants worth arguing about: shell & destructive commands, network calls, credential reads, writes outside the workspace, unpinned launch commands, & text that tells the agent to disregard its instructions. It answers what an agent could do if nobody checked.

Inventories what AI coding agents leave on a machine: full session transcripts, prompt history, cached indexes, & in several cases the API keys they authenticate with. That state survives an uninstall & gets swept into backups, so the tool exists to answer what is still sitting on the disk after the agent is gone.

Reads a packet capture & prints a short report: who talked to whom, over which protocols, which names were asked for, & the handful of things worth a second look. It is aimed at the first ten minutes with a capture you did not take yourself, before opening a full protocol analyser on it.

A terminal roleplay engine for the Gemini API with folder-per-character personas, memory banks, group chats & free-tier budget tracking, so a long session does not quietly run into a quota wall.

A retrieval augmented generation pipeline with nothing hidden behind a framework: chunking, embeddings, cosine similarity search & prompt assembly each sit behind a small swappable interface, so you can see where retrieval quality is actually lost.

Log-based behavioural anomaly detection on the HDFS dataset, built for an AI tools & techniques module. Decision tree classifiers compared against each other with precision, recall & F1 as the yardstick.

Trains a model on a set of images & learns to sort them into classes, written as an exercise in the full training loop rather than a single library call: loading, splitting, fitting & checking.

Predicts housing prices from a CSV using pandas, cleaning & shaping the data first. A useful reminder that most of the work in a model is the part that happens before the modelling.

Converts Ren'Py visual novels into the asset formats & scripting language VNDS expects, which is how a desktop game ends up playable on a DS flash card. Written because doing it by hand, title by title, stopped being fun about two games in.

Firmware & detection logic for a device that attaches under a seat & looks for belongings left behind. Built with a team as a hardware project, from the sensor choice through to how the alert reaches staff.

A small HTTP server written in Python to see what a framework hides: request parsing, routing, status codes & response headers, all by hand.

Collects posts from a web endpoint that offers no API, then displays them in a readable list. Written for a site where checking for updates by hand was the only other option.

Code from a school project to build an integrated development environment, covering the editor side of the problem rather than the language side.

A C# group project from the programming module, built around object-oriented design & a class structure the whole team could work against without stepping on each other.

A command line diary that stores entries on disk, with writing, reading & listing handled through a simple menu. One of the first programs I wrote that kept data between runs.

Hangman in the terminal, used as an excuse to practise class design & to keep game state separate from the code that draws it.

Loads a list of questions from a text file & quizzes the user on them, keeping score along the way. A small exercise in classes & reading structured input.

Works through a maze using loops & grid traversal, written as a first pass at search logic before reaching for a proper algorithm.

Reads a CSV of streamer data & arranges it into a readable summary, which is mostly an exercise in sorting & shaping rows without losing any.

Uses fuzzy matching to search a CSV of films, so a slightly misspelled title still finds the right one. A gentle introduction to string similarity & why exact matching is often the wrong tool.

Takes informal text & swaps it into a formal register using a CSV dictionary of replacements. Small, but the first time I saw a lookup table do the work of a paragraph of code.

A command line farming simulator with crops, days & money. Small but complete, & the first program I wrote where the game loop itself was the interesting problem.

A cooking recipe website built with hand-written HTML & CSS for a term project, laid out before I knew what a framework was.

A small hand-written HTML site, kept around as a marker of where the web work started.