Work
Every entry states what it has to prove before it counts as done. Nothing is marked shipped until its source is public, with a stated result and evidence you can open.
Agent engineering
Agents & Tool Use
Evals
Guardrails & Audit
Integrations
Security
Detection & Response
PLAN · Detection & Response
Sigma Detections With Evidence
Detection rules written as Sigma, converted, and proven firing in the SIEM.
Done when
Sigma rules that fire in the SIEM against a replayed attack, with the alert as evidence.
- sigma
- pysigma
- wazuh
PLAN · Detection & Response
Incident Response, Executed
An incident worked end to end in the lab and written up against NIST 800-61.
Done when
A report covering detection, containment, eradication, and recovery for one real lab incident.
- velociraptor
- cyberchef
- nist-800-61
Cloud Security
PLAN · Cloud Security
AWS IAM Blast-Radius Audit
IAM attack paths walked from initial access to privilege escalation, then closed.
Done when
A least-privilege diff on a live AWS org, with the attack path it closes.
- aws-iam
- cloudgoat
- iam-vulnerable
PLAN · Cloud Security
Cloud Posture, Before And After
A posture assessment with a measured delta, not a screenshot of a tool's dashboard.
Done when
Findings on a real account, remediated, with the before and after score recorded.
- prowler
- scoutsuite
- aws-config
DevSecOps
PLAN · DevSecOps
A Pipeline That Refuses Bad Code
CI that fails the build on secrets, vulnerable dependencies, and static findings.
Done when
One pull request blocked by each of SAST, SCA, secret scanning, and DAST in turn.
- semgrep
- trivy
- gitleaks
- zap
PLAN · DevSecOps
Signed, Minimal, And Inventoried
A distroless image with a generated SBOM and a signature that actually verifies.
Done when
An image whose signature verifies with cosign and whose SBOM lists every layer.
- syft
- cosign
- distroless
- kind
AI Security
PLAN · AI Security
LLM Red-Team Report
A model attacked against the OWASP LLM Top 10 and mapped to MITRE ATLAS.
Done when
Reproducible prompts that break a running model, each mapped to an OWASP LLM entry.
- garak
- ollama
- promptfoo
PLAN · AI Security
Agentic Attack And Defence
Agent attacks and the controls that stop them, in one runnable repository.
Done when
An agent exploited in a lab, then the same attack blocked by a documented control.
- langchain
- rebuff
- promptfoo