Skip to content
View stacknil's full-sized avatar
🧿
Working from home
🧿
Working from home
12 followers · 31 following

Achievements

Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Block or report stacknil

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
stacknil/README.md

stacknil

Systems-oriented defensive security tooling for Linux evidence, product-security workflows, and software supply-chain review.

I build narrow, local-first tools that turn system, repository, and dependency evidence into deterministic artifacts, bounded findings, and reproducible review paths.

Current focus:

  • Linux authentication and process/socket evidence, parser coverage, and telemetry bridges
  • deterministic detection and investigation workflows with schema-validated provenance
  • repository and dependency review gates with redaction, baselines, SARIF, and release evidence

Stable release evidence: LogLens v0.6.0 · telemetry-lab v1.2 · repo-sentinel-lite v0.8.1 · scientific-computing-toolkit v1.1.0 · systems-foundations v0.3.0

Portfolio Map

Repo Primary signal Start here
LogLens C++20 Linux authentication evidence analysis with explicit parser uncertainty, multi-episode detections, and deterministic report contracts README · reviewer path · reviewer brief
telemetry-lab five local detection and investigation workflows with schema-validated artifacts, run manifests, and bounded AI assistance README · reviewer path · reviewer brief
repo-sentinel-lite PyPI-published product-security guardrail with redacted output, baseline-backed scans, changed-file gates, and fail-closed configuration README · reviewer brief
scientific-computing-toolkit release-facing SBOM and dependency review with JSON, Markdown, and SARIF artifacts plus conservative policy and provenance evidence README · reviewer path · reviewer brief
systems-foundations four Linux evidence mini-labs, including a versioned bridge from process/socket diffs to telemetry-lab-compatible JSONL README · reviewer brief
sec-writeups-public public-safe security pattern library with maturity, provenance, sanitization, and publication governance enforced in CI README · reviewer brief

What Ties These Repos Together

  • Linux evidence -> telemetry and detection -> product and supply-chain security review
  • evidence -> normalization -> bounded judgment -> auditable artifact
  • schemas, compatibility notes, provenance, and release evidence are part of the tool contract
  • defensive scope and explicit non-goals matter more than inflated claims

What I'm Building Toward

Monitoring, detection, and product-security engineering where defensive tools must be explainable, compatible with developer workflows, and reproducible by another engineer. The next depth comes from stronger Linux evidence handling, clearer telemetry contracts, and practical repository and supply-chain gates, not from expanding project count.

Publishing Discipline

Public repositories are treated as reviewable artifacts: sanitized inputs, explicit boundaries, deterministic outputs, tests where useful, and documentation that separates tool behavior from release or data claims.

AI assistance may be used for implementation and documentation drafting, but public artifacts are reviewed through tests, deterministic outputs, explicit scope boundaries, and human-maintained release notes.

Near-term focus: deepen evidence contracts, compatibility tests, and consumer reproduction across the existing portfolio.

Reviewer Shortcut

If you only have 5 minutes:

  1. LogLens - Linux auth evidence, parser uncertainty, and detection episode semantics.
  2. telemetry-lab - five local detection workflows, schema contracts, and provenance manifests.
  3. repo-sentinel-lite - PyPI product-security guardrail with redaction, baselines, and changed-file gates.
  4. scientific-computing-toolkit - v1.1 SBOM/dependency review with SARIF, policy, and provenance evidence.

Review Questions

Focused external review is welcome on:

  • parser coverage: are supported, skipped, and unsupported inputs visible?
  • provenance: can a reviewer trace generated artifacts to their committed inputs and configuration?
  • compatibility: are schema, report, and baseline changes explicit and tested?
  • policy boundary: does each warning say what it proves and what it does not prove?

Please open a focused issue in the relevant repository and include the exact command, artifact, or sanitized example under review. Use synthetic or public-safe inputs only.

Writing

Contact

Pinned Loading

  1. LogLens LogLens Public

    C++20 defensive log analysis CLI for Linux auth logs, with parser coverage telemetry, configurable detections, CI, and CodeQL.

    C++ 1

  2. telemetry-lab telemetry-lab Public

    A local, file-based detection workflow lab for reviewer-verifiable telemetry and detection demos.

    Python 1

  3. repo-sentinel-lite repo-sentinel-lite Public

    Deterministic Python CLI for repository hygiene checks and pre-commit secret scanning.

    Python 1

  4. scientific-computing-toolkit scientific-computing-toolkit Public

    Scientific-computing and supply-chain-security toolkit; flagship deterministic SBOM/dependency diff CLI with provenance-aware reporting.

    Python 1

  5. sec-writeups-public sec-writeups-public Public

    Public, sanitized security write-ups from authorized labs, focused on methodology, reusable patterns, and safe publishing.

    Python

  6. systems-foundations systems-foundations Public

    Deterministic mini-labs for Linux and systems foundations.

    Python