Most of my work sits somewhere between incident response, threat intelligence, detection engineering, and building small security tools.

I like understanding how things work, especially when the documentation is incomplete or the answer is buried in logs. Many repositories here began as something I needed for an investigation, a routine task I wanted to simplify, or an idea worth testing in a lab.

Not everything here is a finished product. Some projects are maintained utilities, others are research notes, prototypes, or earlier experiments. I keep them public because sharing the process, including what still needs improvement, can be useful too.

I am usually interested in practical problems, readable code, reproducible findings, and feedback from people who see things differently.

These are useful starting points if you are new to my repositories. The full public catalog is further down.

_{Each repository has its own scope, setup instructions, limitations and license. Please read those before using the code.}

I group my public work by its main purpose rather than by stars or popularity. Some repositories overlap across disciplines, so each one appears once in the catalog below. Archived projects remain listed because they may still be useful as references.

_{39 public repositories in this index. Initial curated snapshot. Run the catalog workflow to include all currently public repositories.}

_{The accompanying GitHub Actions workflow can refresh this directory from all of my public GitHub repositories. Repository metadata and project scopes can change, so each project's own README is the primary source for its current capabilities.}

Evidence before assumptions. I try to distinguish confirmed observations from heuristics, especially in threat intelligence and malware triage.

Small tools are allowed to stay small. A single-purpose script is sometimes more helpful than a complicated platform.

Know the limitations. A suspicious pattern is not always malicious, and a scan result is not a substitute for investigation.

Use the tools responsibly. Anything involving scanning, exploitation, or adversary simulation belongs on systems you own or are explicitly authorized to assess.

Keep learning in public. Bug reports, corrections, ideas, and contributions are welcome. A thoughtful issue can be as helpful as a pull request.

When I have something worth documenting, I usually put it in a repository or write about it here:

• security-life.org for articles and experiments
• Medium and Blogger for longer notes
• LinkedIn and X for occasional updates
• Security Life GitHub community for related open-source work

For a project-specific problem, please use that repository's Issues or Discussions, when enabled. For other conversations, you can contact me at this email address.

If something here saved you a little time, I'm glad it did. If you want to buy me a coffee, thank you, but there is absolutely no obligation.