LogLens
C++20 Linux authentication evidence analysis with explicit parser uncertainty, multi-episode detections, and deterministic report contracts.
About
Defensive security tooling, built from evidence.
Systems-oriented work across Linux evidence, product-security workflows, and software supply-chain review. I build narrow, local-first tools that turn system, repository, and dependency evidence into deterministic artifacts, bounded findings, and reproducible review paths.
Building toward: monitoring, detection, and product-security engineering where defensive tools must be explainable, compatible with developer workflows, and reproducible by another engineer.
Selected Projects
telemetry-lab
Five local detection and investigation workflows with schema-validated artifacts, run manifests, digest provenance, and bounded AI assistance.
repo-sentinel-lite
PyPI-published product-security guardrail with redacted output, baseline-backed scans, changed-file gates, and fail-closed configuration.
scientific-computing-toolkit
Release-facing SBOM and dependency review with JSON, Markdown, and SARIF artifacts plus conservative policy and provenance evidence.
systems-foundations
Four Linux evidence mini-labs, including a versioned bridge from process and socket diffs to telemetry-lab-compatible JSONL.
sec-writeups-public
A public-safe pattern library: 8 stable security patterns extracted from 10 source notes, with maturity and provenance enforced in CI.
Reusable Security Patterns
Parser uncertainty
Keep unsupported input visible instead of treating parser gaps as negative evidence.
Authentication burst triage
Bound authentication clusters without turning repeated failures into a compromise verdict.
Multi-user probing
Distinguish username spread from ordinary repeated failure by one account.
Alert deduplication
Collapse duplicate alerts while preserving representative evidence and escalation signals.
Bounded correlation
Require a reproducible join key, event sequence, and time window before claiming a chain.
Repository baseline governance
Review suppression drift as security-adjacent code rather than invisible maintenance.
SBOM policy warning
Explain why a dependency diff warned without inventing a package-safety verdict.
Human verification boundary
Keep AI-assisted drafts separate from evidence-backed, human-owned findings.
Writing
LogLens / Parser Uncertainty as Evidence
Why unsupported input must remain visible instead of silently becoming negative evidence.
telemetry-lab / Evidence Pipeline Contract
How reviewer-facing events, findings, summaries, reports, and audit traces stay schema-validated.
sec-writeups-public / SBOM Policy Warning
How to explain a dependency policy warning without inventing a package-safety verdict.
Contact