Systems-oriented defensive security tooling for Linux evidence, product-security workflows, and software supply-chain review.
I build narrow, local-first tools that turn system, repository, and dependency evidence into deterministic artifacts, bounded findings, and reproducible review paths.
Current focus:
- Linux authentication and process/socket evidence, parser coverage, and telemetry bridges
- deterministic detection and investigation workflows with schema-validated provenance
- repository and dependency review gates with redaction, baselines, SARIF, and release evidence
Stable release evidence: LogLens v0.6.0 · telemetry-lab v1.2 · repo-sentinel-lite v0.8.1 · scientific-computing-toolkit v1.1.0 · systems-foundations v0.3.0
| Repo | Primary signal | Start here |
|---|---|---|
| LogLens | C++20 Linux authentication evidence analysis with explicit parser uncertainty, multi-episode detections, and deterministic report contracts | README · reviewer path · reviewer brief |
| telemetry-lab | five local detection and investigation workflows with schema-validated artifacts, run manifests, and bounded AI assistance | README · reviewer path · reviewer brief |
| repo-sentinel-lite | PyPI-published product-security guardrail with redacted output, baseline-backed scans, changed-file gates, and fail-closed configuration | README · reviewer brief |
| scientific-computing-toolkit | release-facing SBOM and dependency review with JSON, Markdown, and SARIF artifacts plus conservative policy and provenance evidence | README · reviewer path · reviewer brief |
| systems-foundations | four Linux evidence mini-labs, including a versioned bridge from process/socket diffs to telemetry-lab-compatible JSONL | README · reviewer brief |
| sec-writeups-public | public-safe security pattern library with maturity, provenance, sanitization, and publication governance enforced in CI | README · reviewer brief |
- Linux evidence -> telemetry and detection -> product and supply-chain security review
- evidence -> normalization -> bounded judgment -> auditable artifact
- schemas, compatibility notes, provenance, and release evidence are part of the tool contract
- defensive scope and explicit non-goals matter more than inflated claims
Monitoring, detection, and product-security engineering where defensive tools must be explainable, compatible with developer workflows, and reproducible by another engineer. The next depth comes from stronger Linux evidence handling, clearer telemetry contracts, and practical repository and supply-chain gates, not from expanding project count.
Public repositories are treated as reviewable artifacts: sanitized inputs, explicit boundaries, deterministic outputs, tests where useful, and documentation that separates tool behavior from release or data claims.
AI assistance may be used for implementation and documentation drafting, but public artifacts are reviewed through tests, deterministic outputs, explicit scope boundaries, and human-maintained release notes.
Near-term focus: deepen evidence contracts, compatibility tests, and consumer reproduction across the existing portfolio.
If you only have 5 minutes:
- LogLens - Linux auth evidence, parser uncertainty, and detection episode semantics.
- telemetry-lab - five local detection workflows, schema contracts, and provenance manifests.
- repo-sentinel-lite - PyPI product-security guardrail with redaction, baselines, and changed-file gates.
- scientific-computing-toolkit - v1.1 SBOM/dependency review with SARIF, policy, and provenance evidence.
Focused external review is welcome on:
- parser coverage: are supported, skipped, and unsupported inputs visible?
- provenance: can a reviewer trace generated artifacts to their committed inputs and configuration?
- compatibility: are schema, report, and baseline changes explicit and tested?
- policy boundary: does each warning say what it proves and what it does not prove?
Please open a focused issue in the relevant repository and include the exact command, artifact, or sanitized example under review. Use synthetic or public-safe inputs only.
- LogLens / parser uncertainty as evidence
- telemetry-lab / evidence pipeline contract
- systems-foundations / 408 to Linux security
- sec-writeups-public / SBOM policy warning
- GitHub: @stacknil
- Site: stacknil.github.io
- Email: stacknil@proton.me