Background on the tools I build, the ones I discover elsewhere, and other things I'm learning.
I wanted to exercise a complete KEEN installation through its real browser, proxy and API. Two standalone qubes and a pair of scripts now restore a golden dataset, run application-specific security checks, save the evidence and tear the installation down again.
Read moreI built KEEN to connect the work an organisation already does with the requirements it needs to demonstrate. Collect evidence, map it to frameworks, measure effectiveness and audit it in one workspace. Try a free 30-day demo, or work with me to shape KEEN around your organisation.
Read moreOne of my longest clients is winding up. My availability is freeing up for the first time in many years, but like many sole traders, I have not done a good job of self-promotion. Will the industry remember me?
Read moreGoogleCloudPlatform's Terraformer was archived in March 2026 and is now read-only, with no further updates or security patches. Heckle is my answer to that gap for git forges: it inventories an existing GitHub, GitLab, Gitea or Forgejo namespace and generates maintainable Terraform or OpenTofu HCL you can adopt and then manage without Heckle.
Read morestef is a new grep-style search tool in native Rust, built on ripgrep's own search crates, that transparently detects and decrypts SOPS files inside otherwise ordinary directory trees - and keeps an encrypted local history of what matched, so it can answer a question grep never could: what used to match this search, but doesn't match now?
Read moreDumpTales' hottest loop is splitting mysqldump's giant VALUES statements into rows and values. A CPython extension makes it dramatically faster. Here is why!
Read moreGills watches APT and RPM repositories for package additions, version changes, repacks and removals, and routes events to webhooks, email, Slack, Signal or stdout. It started as a way to learn the moment new PHP packages enter Ondrej's Sury repository so I can rebuild PHP-SQLCipher, without ever installing that repository on any of my own servers.
Read moreVersion 0.9.0 improves secret screening, file handling, service discovery and the order in which generated Ansible runs. It also brings multiple hosts into one project, with shared roles and each host’s own configuration.
Read moreAn Alloy config that tails OSSEC's alerts.json, parses it into Loki labels, normalises the hostname, pads the rule level for sorting, and exports a counter metric for alerting.
Read moreThis is a script that audits OpenVPN certificates against a known-good list, has a --warn-days flag for expiry monitoring, and has good outputs suitable for both humans and CI.
Read moreI built DumpTales to answer a familiar question after taking two database backups: what actually changed? Here is a small pair of SQL dumps and the row-level story they tell.
Read moreI use CloudTrail Event History to spot management API calls from outside my expected networks. The script groups findings by actor, handles repeated scans, and sends a JSON summary to a webhook. Here is where it helps, how to run it, and what it cannot see.
Read more