Tooling

Open Source Tooling

Security tools and infrastructure built for malware research, vendor risk assessment, supply chain analysis, and AI security research.

Security Tools

Go-first tools for malware research, vendor risk, and supply chain analysis.

grepWatchFlagship

Open-source dependency behavioral diff engine. Detects malicious changes across npm, PyPI, Go, Cargo, Maven, and NuGet by comparing what a package actually does between versions, not just what it declares. Live at grepwatch.com.

malsnitchFlagship

Malware secrets scanner to acquire threat actor credentials from analyzed malware samples.

riskware-action

Scan your open-source dependencies for CVEs, public exploits, and supply chain compromises on every pull request.

A collection of three powerful Go-based security analysis tools for malware research and threat intelligence.

A simple Windows command line script that utilizes the OpenAI API to pull several useful data points when risk ranking third-party vendors.

A list of jailbreak prompts using indirect prompt injection based on SQL, Splunk, and other query language syntax. These prompts can get LLMs to behave outside their normal ethical boundaries, and any tool or service using the OpenAI API appears susceptible.

Security Labs

Terraform labs that deploy on Azure behind Bastion, with no public IPs, and tear down with one command.

grepLabsFlagship

A general-purpose Azure security research lab built with Terraform. Four VMs (Ubuntu, Windows Server 2022, Windows 11, Kali) on a private network behind Azure Bastion, reconfigurable as a reverse engineering environment, CI/CD supply chain lab, detection engineering testbed, or a burner box for reaching hostile infrastructure. No VM has a public IP.

An Azure lab for CI/CD and software supply chain security testing. Three VMs, two CI runners plus a stock-Ubuntu adversary/DAST node, behind Azure Bastion, wired with SBOM scanning, host telemetry, and offensive tooling for simulating supply chain attacks against your own pipeline.

A single burnable Kali Linux VM, built with Terraform, for safely visiting ransomware data leak sites. Validate what a threat actor posted, then terraform destroy so nothing sticks to your own infrastructure.

A rapidly deployable AI red-team lab. An attack VM running a local uncensored LLM against a victim VM running OpenClaw, isolatable from the internet with a single config flip. Built for practicing prompt injection and agentic-AI attacks.