Linux server hardening auditor in pure Bash. Thirty-four read-only checks across SSH, filesystem, accounts, network exposure, Docker, and leaked credentials.

Reads the effective SSH config through sshd -T rather than parsing the file, so an override further down cannot hide a weak setting. JSON output for CI.

bash · security · devsecops

Zero-downtime deploys for servers you reach over SSH.

The release swap is an atomic rename(2), so no request ever sees a half-updated document root. Health-checked automatic rollback, manual rollback, and a preflight that catches the failures that strand a deploy halfway.

devops · ci-cd · bash

Detection-only WordPress scanner. Finds the misconfigurations that actually get sites compromised: readable wp-config backups, exposed debug logs, user enumeration, open XML-RPC.

It observes and never exploits, which is what makes it safe to point at production. Scans a real WordPress container in CI.

wordpress · security · python

Certificate monitoring that tells you what is wrong, not that something is.

An expired certificate fails verification, so most checkers can only report "connection failed". This one handshakes again without verification to read the certificate and comes back with expired 40 days ago.

tls · monitoring · python

See inside a crontab before it surprises you. Predicts real run times and catches the mistakes that cause silent incidents: Feb 30, midnight collisions, and the 0 0 13 * 5 trap where day-of-month and day-of-week are combined with or, not and.

Renders the week as a heatmap. Cross-checked against croniter in CI. Try it in your browser.

cron · devops · visualization

A deterministic groundedness linter for retrieval answers. Flags fabricated numbers, unsupported claims, and broken citations.

A model asked to judge another model scores differently on each run, so it cannot gate a pipeline. This returns byte-identical output for identical input, proven across seeds, which is what makes it usable in CI. Try it in your browser.

llm · rag · ai-safety

Finds the one request that failed inside a log stream nobody can read by eye. Lines that are structurally the same are collapsed into a single pattern with a count, and the rarest patterns are shown first, because the line that appears once in ten thousand is usually the one you are looking for.

Reads stdin, so it composes with tail, kubectl logs, and journalctl. Handles JSON and plain text. The README says plainly where the heuristic merges two lines a human would keep apart.

logs · observability · python

Checks that a README is true. Every command, path, make target, package script, module and environment variable a document asserts is pulled out and checked, and the run exits non-zero when one fails.

A local model reads the prose to find claims but never decides whether one holds; the checks do. It started with a real bug: a deploy guide of mine whose every command had pointed at the wrong path since the scripts moved.

documentation · ci · llm

Video downloads for offline viewing, built on yt-dlp. A file is fetched over several bounded range requests at once, picked to fit the disk you have, and resumed range by range after an interruption. In its own benchmark four connections ran four to six times faster than one.

Ships as a command, a native SwiftUI app for macOS, and a Firefox add-on that hands downloads to it over native messaging, tested together in a real Firefox in CI.

python · swiftui · firefox

Study long YouTube videos like a course. Chapters become a checklist that ticks itself only after real playback, so seeking past a chapter or an ad playing does not count, with notes pinned to the moment and a Markdown export.

Manifest V3 for Chrome and Firefox, English and Arabic, no server. Tested end to end in Chromium against a local copy of the watch page, never against YouTube.

javascript · browser-extension · i18n

Gold Engine

Async SMC trading engine for XAUUSD. Event-driven asyncio, Numba-compiled hot paths, constant work per tick, around 13.7k lines.

asyncio · numba · numpy

Zeem

Dashcam video to the browser in under a second. JT1078 to MediaMTX to WebRTC, with a Laravel backend across three environments.

webrtc · mediamtx · laravel

Watheeq Pro

Enterprise multi-tenant SaaS under its own organisation, split across service repositories with a staged rollout.

saas · multi-tenant · laravel

masar

Locating wide-area network degradation from traffic a fleet already sends, with no access to the routers in between.

tomography · networking · python