Built from real work
Some came out of security research, some out of scratching our own itch. If we kept rewriting the same script, it became a project.
- Filter by
Why a security firm ships products
Every tool here started as something we needed inside an engagement or kept rebuilding for ourselves — a scanner for a repetitive check, a helper for a workflow that took too long, a small product that grew out of a research thread. We publish them because the alternative is letting them rot in a private repo, and because shipping forces a different standard of quality than a one-off script does.
The practical effect for clients: the same codebase that finds the flaw is often the one we built to test for it. Our tooling is exercised on real targets every week, which keeps the testing sharp and keeps the tools honest. When a product here breaks, we learn something about a real attack path — that loop is the point.
Status badges are literal: active means maintained, beta means usable but changing, archived means kept for reference. If something here solves a problem you have, use it — and if it almost does, that is worth a conversation.