Cybersecurity student · self-hosted infrastructure, Zero Trust access control, detection engineering
A self-hosted LLM stack running on my own hardware, published through Cloudflare Tunnel and gated by Zero Trust access policies. Status below is checked server-side against the real origin, not guessed from the browser.
Built against infrastructure I run and defend. Each README documents the design tradeoffs and the limitations honestly.
Verifies that hostnames are actually behind Zero Trust access controls, not merely online. Written after I found two of my own subdomains serving unauthenticated traffic while the dashboard showed a correctly-configured policy — the application was bound to the apex domain instead of the service subdomains, and every uptime monitor would have called both hosts healthy.
A hostname that sounds worth attacking, hosts nothing, and fingerprints every scanner that finds it. Deliberately does not harvest submitted credentials — storing credential-stuffing attempts means operating a secrets database with no lawful use, and those passwords often belong to real victims whose machines are part of a botnet. It logged its first uninvited traffic within minutes of deployment, from addresses that found it via certificate-transparency logs.
Detection engineering over Cloudflare Access authentication events — six rules including success-after-denial, the shape of a successful intrusion following a failed one. The README documents a correction I had to make to my own design: I assumed the audit log carried no geolocation and built around that, then checked the live API and found a country field on every event. The rule is named country-change rather than impossible-travel, because coordinates still aren’t available and it should be called what it measures.
A locally-hosted model writes operator briefings over my telemetry, with output verified against the source data before it is trusted. The finding I care about is where it still fails: token-level verification catches fabricated values but not fabricated relationships between values that are individually real. A run that passed verification still miscounted seven paths as nine.
Network inventory and drift detection in dependency-free PowerShell. ARP-first discovery rather than a port scan, and diffed by MAC rather than IP so DHCP churn doesn't masquerade as new devices. Documents its own edge cases, including a MoCA bridge presenting two addresses behind one MAC.
Aggregates all three monitors into one daily Telegram message, and answers /status on demand. Sends unconditionally, including when nothing happened — an alerts-only setup is indistinguishable from a broken alerts-only setup, because silence means either “all clear” or “the pipeline died three weeks ago.” Sibling Workers are wired together with service bindings rather than public URLs.
Windows desktop application that visualizes what is consuming disk space — treemap rendering, threaded scanner, and guarded deletion that tags anything Windows depends on.