Tools of my own, platforms, sites in production, labs and analysis of already disclosed vulnerabilities. The private ones say why they are private.
14 of 14 projects
Self-hosted cybersecurity platform for small companies. It brings asset inventory, vulnerability management, threat intelligence, Spanish ENS compliance, backups, device fleet and staff training into a single workflow. It is built as modules, and some stand on their own: Talos came out of it.
Commercial product under development. The code is not public, but the architecture and the decisions behind it can be described.
Hardening audit for Linux and Windows servers in a single dependency-free binary. Read-only, it never changes anything, and finishes a full server in under ten seconds. It carries 147 checks written as data files, each with its severity, weight, the Spanish ENS controls it covers and how to remediate it. It came out of a larger platform and I released it separately because it stood on its own.
★ 1GoSept 2026
My own studio, building websites for freelancers and small businesses on a subscription basis. Static sites with security headers and a restrictive content policy, no third-party trackers, and deployments that roll back in one click. The client never has to learn any of it.
The studio's code and its client sites are not public.
Metabase published a maximum-severity advisory without explaining the vector, giving only a log signature to search for. Two well-known companies had already confirmed attacks through the same flaw. I built a lab with three containers, two vulnerable versions and one patched, and reconstructed the mechanism by sending identical requests to both: the vulnerable one ran a query the patched one did not, with a value I had not supplied anywhere.
The lab and the proof of concept are not published. The flaw is patched, but thousands of exposed instances remain unpatched, so this describes the mechanism and not how to exploit it.
Non-profit platform bringing Spain's cybersecurity conferences and events together in one place, with a map, filters and alerts. I owned project security from the design stage: threat modelling before any code, two continuous integration pipelines with static and dependency analysis, and dynamic testing against the deployment. Five vulnerabilities came out, two critical, and all were fixed before production.
The code sits in private repositories while the platform is still in beta.
A logic flaw in the Linux kernel's cryptographic subsystem lets an unprivileged local user write four controlled bytes into the page cache of any readable file on the system. That is enough to alter the behaviour of a privileged binary such as su, in memory and without touching the file on disk. It escapes containers, because they share the page cache with the host. I studied it over a long weekend, reproduced it on Debian 13, Ubuntu 24.04, Kali and Docker, and wrote variants in several languages, including one in C that compiles with gcc and runs on any distribution with no dependencies.
★ 7RustMay 2026
The studio's first client, a home renovation company in Madrid. A static site built to generate calls: instant loading, a work gallery optimised during the build itself, and careful technical SEO. Delivered and under maintenance.
This is client work and its code is not public.
Five machines across four isolated segments, with a Windows domain and a monitoring hub, defined entirely as code and brought up with a single command. I built it for my Master's final project, and I use it to practise lateral movement and detection without touching anything that is not mine.
It contains configuration and credentials for a test environment, so it is not published.
Server, firewall and team modules for standing up infrastructure on Hetzner repeatably, with automated boot and idempotent provisioning. This is what I use to avoid building servers by hand and to be able to destroy and recreate them without worrying.
It describes infrastructure in use, so it is not published.
Five security controls packaged as reusable GitHub Actions workflows: secret leakage, static analysis, dependency analysis, container image scanning and dynamic testing. The idea is that any repository imports them with one line instead of copying configuration that goes stale.
The workflows reference private repositories, so it is not published yet.
Monitoring for an uninterruptible power supply, with alerts and an orderly hypervisor shutdown when the battery drops below a threshold. I built it after losing a machine to a power cut, which is the classic way to learn that an unclean shutdown is an availability problem too.
It is configuration for my own infrastructure and is not published.
Keycloak with PostgreSQL and a realm imported declaratively at startup, so a test identity provider is reproducible without configuring it by hand every time.
★ 0Jul 2026
A Linux, Nginx, database and PHP stack on current versions, ready to bring up in seconds. I built it to stop wasting time setting up the environment every time I wanted to practise, and published it because it was just as useful to others.
★ 0PHPOct 2025
My own project to offer security auditing and consulting to companies in Cantabria. It is on hold while the placement and the Master's take up the calendar, and the plan is to pick it up when Talos and Argos are more mature and there is something concrete to sell.
My own project, on hold and not published yet.
Exercise repositories from my studies. Not projects: they are here because the path happened and can be checked.