Selected Evidence
Security case studies and labs from my learning log. Each one says what I did, how I checked it, and where its limits are. For the wider picture of what I build, see what I'm doing.
Evidence-led
Each item starts with an outcome that can be explained and checked.
Security judgement
The focus is the decision, the trade-off, and the control behind the tool.
Honest scope
Feature-gated, test-only and training-scenario work is labelled as such, never presented as live production capability.
Finished documents written for someone to act on: findings, evidence, priorities and what was fixed.
Report 10Oct 5, 2026
A bounded training report on inspecting a supplied sample.pcap in Wireshark, documenting visible network facts, and identifying what the capture cannot prove.
Report 09Oct 1, 2026
A qualitative risk assessment of the system I run: twelve risks identified, scored for likelihood and impact, ranked, and paired with a treatment. Likelihood is grounded in incidents that actually happened here.
Report 08Oct 1, 2026
I ran my own website check-up service against my own site. It found nine things. Six were fixed and one partly fixed the same day, and re-checked. Two are still open, and the tool got two things wrong.
Report 07Sep 10, 2026
A chat-bot credential was sitting in an automation workflow. This report covers containment, why deleting it was not enough, the rotation, and a second failure where the rotation tool said it had worked and had not.
Report 06Sep 3, 2026
A restore drill, written up as a test report. The backup was encrypted and kept off the main machine, then restored elsewhere and checked: 2,606 files, 21 database tables, 64,977 rows, without touching the live service.
Report 05Aug 19, 2026
A post-incident report on an unexplained remote shutdown in my AI agent setup: what was ruled out, the path that allowed it, the fixes, and how both fixes were nearly lost in a merge the next day.
Report 04Aug 3, 2026
A formal write-up of a server-side request forgery flaw in a tool I built so an AI agent could read web pages. Four independent review rounds found five ways past its protections. All five are fixed and regression-tested; one transport remains untested.
Report 03Aug 2, 2026
A dependency security audit of the agent gateway I run on my own machine. 76 known-vulnerability findings were reduced to 2 in a first pass and to 0 in a second, without hiding any behind a version number.
Report 02Jul 23, 2026
A root-cause report on a local web service that degraded until it refused connections. One helper function leaked a file handle on every call. The report covers the diagnosis, a one-place fix, and a test that could have failed.
Report 01Jul 6, 2026
An audit of the iPhone app and the service behind it that let me run AI agents remotely. It found an unauthenticated service, a command filter that could be bypassed, and tasks marked done that were not. All were fixed and re-audited the same week.
Case study 11Oct 5, 2026
A training case study showing how I used Wireshark and a supplied sample capture to record network observations, separate facts from interpretation, and prepare a defensible SOC handoff.
Case study 10Oct 1, 2026
A practical PASTA threat-modeling exercise for a mobile sneaker marketplace, covering business objectives, architecture, data flows, threats, vulnerabilities, attack paths, and mitigations.
Case study 09Sep 23, 2026
A scenario-based assessment of a business-critical MySQL database reachable from the internet: risks identified and prioritised with NIST SP 800-30, plus remediation and validation steps. No live system was touched.
Case study 08Sep 5, 2026
Wake and sleep treated as two separate trust decisions: wake adds no new authority, and sleep goes through a local-only bridge that can run one fixed command.
Case study 07Sep 2, 2026
An encrypted off-machine backup of my agent's database, verified by restoring it on a second machine and checking structure, contents and integrity.
Case study 06Aug 18, 2026
A Mac in my setup was powered off by a chat message with no clear cause. I traced the path that allowed it, closed it, and made shutdown default-deny with a record of every caller.
Case study 05Aug 2, 2026
I built the guard that stops an agent tool fetching internal addresses, ran an independent review of my own fix, and found two live bypasses before either was patched.
Case study 04Jul 27, 2026
How I evaluated candidate tools: pinned source revisions, comparison with a manual baseline, bounded trials, and clean removal for the ones that did not earn their place.
Case study 03Jul 21, 2026
The verification layer around my agent supervisor: success needs evidence, checks fail closed, decision changes are shadow-tested, and recovery is rehearsed.
Case study 02Jul 18, 2026
A way to hand one task's report to one recipient without giving storage access: single-purpose expiring links, integrity checks before delivery, and durable delivery state.
Case study 01Jul 17, 2026
I designed and tested a supervision layer for a local AI agent: task-scoped permissions, approvals, audit records and restart-safe controls. Feature-flagged and fixture-tested, not live.
Lab 07Jul 14, 2026
Handling a noisy alert from my own tooling: reproduce it, find why it fires, narrow it, and keep a test so real problems are still caught.
Lab 06Jul 5, 2026
Creating and removing Linux users and groups and assigning ownership, from a security analyst's point of view.
Lab 14Aug 2, 2026
Builds a small guard that stops a program fetching internal addresses, then attacks it the way two real bypasses were found.
Lab 26Sep 18, 2026
Google Cybersecurity Certificate worksheet: analysing a simulated payroll change, what the logs prove about who made it, and which access controls failed.