I build small defensive systems tools for Linux evidence, telemetry workflows, repository hygiene, and reviewable security artifacts.
Current focus:
- C++20 log analysis for Linux authentication evidence
- deterministic local detection workflows
- repository hygiene and lightweight secret-adjacent scanning
- public-safe security writing with explicit boundaries
| Repo | Primary signal | Start here |
|---|---|---|
| LogLens | C++20 defensive log analysis for Linux auth evidence, with parser coverage telemetry and deterministic reports | README · reviewer path · reviewer brief |
| telemetry-lab | reviewable telemetry and detection demos: windowing, dedup, bounded AI-assisted case drafting, and config-change investigation | README · reviewer path · reviewer brief |
| repo-sentinel-lite | deterministic repository hygiene and lightweight secret-adjacent scanning with baselines and pre-commit integration | README · reviewer brief |
| scientific-computing-toolkit | scientific and supply-chain review infrastructure, currently led by sbom-diff-and-risk |
README · reviewer path · reviewer brief |
| systems-foundations | Linux auth and networking state mini-labs with deterministic normalization and report artifacts | README · reviewer brief |
| sec-writeups-public | sanitized security notes and reviewer-friendly publication governance | README · reviewer brief |
- systems -> telemetry -> security is the main technical arc
- outputs should be inspectable by a human, not just runnable once
- documentation is part of the artifact, not cleanup after the artifact
- defensive scope and explicit boundaries matter more than inflated claims
Public repositories are treated as reviewable artifacts: sanitized inputs, explicit boundaries, deterministic outputs, tests where useful, and documentation that separates tool behavior from release or data claims.
AI assistance may be used for implementation and documentation drafting, but public artifacts are reviewed through tests, deterministic outputs, explicit scope boundaries, and human-maintained release notes.
Near-term focus: stabilize review paths, tests, documentation boundaries, and release evidence rather than expanding project count.
If you only have 5 minutes:
- LogLens - C++20 Linux auth log analysis with parser observability.
- telemetry-lab - deterministic detection workflow demos.
- repo-sentinel-lite - PyPI-published repository hygiene CLI.
- scientific-computing-toolkit - SBOM/dependency risk review plus scientific diagnostics.
- telemetry-lab / design notes
- systems-foundations / text processing pipelines
- sec-writeups-public / SOC Fundamentals
- GitHub: @stacknil
- Site: stacknil.github.io
- Email: stacknil@proton.me


