Working tools with tests and CI — not write-ups. Where a tool has limits, the repo says so out loud.

Ports a CUDA repo until it builds and passes its tests on AMD GPUs, one reviewable commit per fix.

The interesting part is the trust boundary: it runs untrusted repo code and applies LLM-written diffs — so every diff passes a mechanical policy gate before it touches disk. Path allowlist checked on both sides of each hunk, forbidden-insertion denylist, no editing of tests, size caps, symlink/mode/traversal rejection. A red-team test proves the gate rejects a live prompt-injection payload.

Proven on real AMD hardware (Radeon gfx1100, ROCm 7.2) — autonomous port to a passing ctest in 3 iterations. → Try it with zero install

Sits in front of an LLM app and detects prompt injection, jailbreaks, secret/PII leakage and system-prompt extraction in real time. Detections are versioned YAML rules carrying per-rule OWASP LLM Top 10 and MITRE ATLAS IDs, with SOAR playbooks, a Streamlit SOC dashboard and a SIEM sink.

Its red-team harness scores its own detection and false-positive rates, publishes every miss, and gates CI on them.

Point it at the same JSON config your MCP client already uses. Reports PASS/FAIL/INFO with exact remediation for hardcoded secrets, unauthenticated endpoints, missing Origin validation (CVE-2025-49596), weak session IDs and inconsistent tool annotations.

Every check is tagged spec-backed or inferred, so heuristics are never dressed up as violations. Detection only — no exploitation.

Patches sent to the security and infrastructure tools I actually use — working inside large unfamiliar codebases, to each project's own review process.

Project	Contribution	Status
supabase/supavisor	Documented the citext + pgbouncer=true slowdown and its remedy

Screens every package in a requirements.txt / package.json against the live PyPI and npm APIs before installation — typosquat risk via edit distance and confusable-character folding (rn→m, 0→o), plus registry-age and release-count heuristics. Emits a versioned JSON report for CI gating and a cleaned manifest.safe.

The README has a "Deliberately not implemented" section: maintainer account-age isn't exposed by the public registry APIs, so that signal is marked unavailable rather than guessed.

HEIC→JPG, image compress/resize, EXIF/GPS and PDF metadata stripping — where the no-upload guarantee is enforced by a strict CSP with connect-src 'none', not merely promised. Stripping logic is factored DOM-free so CI can geotag a JPEG and prove the GPS is actually gone.

A from-scratch simulator of an islanded, droop-controlled IEEE 33-bus microgrid (no slack bus), used to mount minimum-footprint FDI attacks (a = Hc) that pass χ² bad-data detection while driving real frequency and voltage excursions into UFLS/UVLS relay trips.

Ships labelled datasets and a non-circular detectability study — the headline numbers recompute exactly from the committed CSVs.

_{No security angle claimed here — this is systems work.}

Project	What it does
kvpolicy	Quantized KV-cache persistence for local LLM agents — resume a suspended session at 3.8× compression, 7–14× faster than re-running prefill. Also reports a negative result against its own hypothesis: attention-based eviction holds perplexity flat while destroying up to 61% of exact fact recall.
prefixforge	Compiles agent prompts into byte-stable, maximally cacheable prefixes (canonical tool schemas, dynamic-span detection, provider-correct breakpoints), then measures the cache hit rate providers actually report back.
greenToken	Measures energy, CO₂e and cost of LLM inference per token from real hardware counters (NVML, nvidia-smi, Linux RAPL), with a documented FLOPs fallback for hosted models.