Defensive security tools, research experiments and technical write-ups across multiple languages and platforms.
Security Lab is a project-oriented monorepo for small, auditable defensive security tools and the research notes behind them. Each implemented project must include working code, behavioral tests, reproducible examples, and documentation of its security boundaries.
- Build transparent tools for detection, analysis, and security validation.
- Keep parsing, detection, and presentation concerns independently testable.
- Document design choices and limitations alongside the implementation.
- Support multiple languages when a project's constraints justify them.
- Use only local data unless a project explicitly documents an authorized network operation.
| Area | Focus |
|---|---|
| Detection Engineering | Explainable, rule-based detections and findings |
| Log Analysis | Parsing and normalization of security-relevant logs |
| Host Security | File, process, authentication, and configuration visibility |
| Network Visibility | Authorized inventory and defensive traffic analysis |
| Web Security | Configuration review and observable web behavior |
| Linux Security | Authentication and operating-system telemetry |
| Windows Security | Event-log and host-control research |
| Secure Software Engineering | Testing, dependency review, and defensive defaults |
| Project | Description | Status |
|---|---|---|
| Security Log Analyzer | Detect suspicious patterns in server and authentication logs | In Development |
| HTTP Header Auditor | Audit web security headers through a pinned and bounded request, then compare saved reports | In Development |
| File Integrity Monitor | Detect unexpected file changes using cryptographic hashes | Planned |
| SSH Attack Detector | Monitor live SSH authentication telemetry and emit defensive alerts | Planned |
| Network Inventory | Inventory hosts and exposed services in authorized networks | Planned |
The current implementation focus covers two command-line tools:
- Security Log Analyzer analyzes existing or growing Apache/Nginx access logs and Linux
auth.logfiles before applying configurable web and SSH correlation rules. - HTTP Header Auditor makes one bounded request to an explicitly authorized public endpoint, produces an explainable security-header coverage report, and compares two saved reports locally to surface control regressions.
Python 3.12+ is the first implementation language. The repository may also use Go, Rust, PowerShell, Bash, JavaScript, TypeScript, C, or C++ where a project benefits from a different runtime or platform API. Projects are grouped by security problem - not programming language.
flowchart TD
A[Security Lab] --> B[Projects]
A --> C[Experiments]
A --> D[Write-ups]
A --> E[Documentation]
B --> F[Working defensive tools]
C --> G[Bounded research]
D --> H[Reproducible analysis]
E --> I[Architecture, guides, examples, ADRs]
Security Log Analyzer:
cd projects/security-log-analyzer
python -m venv .venv
# Windows PowerShell: .venv\Scripts\Activate.ps1
# Linux/macOS: source .venv/bin/activate
python -m pip install -e ".[dev]"
security-log-analyzer analyze samples/apache_access.logHTTP Header Auditor:
cd projects/http-header-auditor
python -m venv .venv
# Windows PowerShell: .venv\Scripts\Activate.ps1
# Linux/macOS: source .venv/bin/activate
python -m pip install -e ".[dev]"
http-header-auditor audit https://your-authorized-site.exampleSee each project README for CLI options, examples, security boundaries, and known limitations.
Each implemented Python project has independent CI for Ruff linting and formatting checks, pytest with coverage, mypy, Bandit, and pip-audit. The equivalent local commands are documented in the development setup guide.
The documentation index links to repository architecture, the detection pipeline, extension guides, report examples, and Architecture Decision Records. Documentation is updated with behavior-changing code.
Read CONTRIBUTING.md before proposing changes. Security-sensitive reports belong in a private GitHub Security Advisory as described in SECURITY.md, not a public issue.
Active and planned work is tracked in ROADMAP.md. Planned projects contain scope documents only; they do not claim an implementation.
All tools in this repository are intended for defensive security, education and authorized security testing. Only use them on systems and networks you own or are explicitly authorized to assess.
The project does not include malware, credential theft, persistence, evasion, or automated exploitation. Sample data is fictional and uses reserved documentation address ranges.
Maintained by MYNAMEISKILLUA - Software Engineer - Security Researcher - Automation Developer.
Licensed under the MIT License.