Systems, telemetry, defensive tooling, and reviewable security artifacts.
I build small public repositories that are intentionally narrow, reproducible, and easy for a reviewer to inspect without guessing at hidden scope.
Current direction:
- systems foundations that make later telemetry and security work legible
- monitoring and detection-oriented tooling
- deterministic local workflows over black-box demos
- public-safe security writing with explicit boundaries
| Repo | Primary signal | Start here |
|---|---|---|
| LogLens | C++20 defensive log analysis for Linux auth evidence, with parser coverage telemetry and deterministic reports | README · reviewer brief |
| telemetry-lab | reviewable telemetry and detection demos: windowing, dedup, bounded AI-assisted case drafting, and config-change investigation | README · reviewer brief |
| repo-sentinel-lite | deterministic repository hygiene and lightweight secret-adjacent scanning with baselines and pre-commit integration | README · reviewer brief |
| scientific-computing-toolkit | scientific and supply-chain review infrastructure, currently led by sbom-diff-and-risk |
README · reviewer brief |
| systems-foundations | Linux auth and networking state mini-labs with deterministic normalization and report artifacts | README · reviewer brief |
| sec-writeups-public | sanitized security notes and reviewer-friendly publication governance | README · reviewer brief |
- systems -> telemetry -> security is the main technical arc
- outputs should be inspectable by a human, not just runnable once
- documentation is part of the artifact, not cleanup after the artifact
- defensive scope and explicit boundaries matter more than inflated claims
Public repositories are treated as reviewable artifacts: sanitized inputs, explicit boundaries, deterministic outputs, tests where useful, and documentation that separates tool behavior from release or data claims.
AI assistance may be used for implementation and documentation drafting, but public artifacts are reviewed through tests, deterministic outputs, explicit scope boundaries, and human-maintained release notes.
If you only have 5 minutes:
- telemetry-lab - detection workflow and bounded AI-assisted analyst drafting.
- LogLens - C++20 Linux authentication log analysis with parser observability.
- repo-sentinel-lite - PyPI-published repository hygiene CLI with baselines and pre-commit support.
- scientific-computing-toolkit - SBOM/dependency risk review plus supporting scientific-data diagnostics.
- telemetry-lab / design notes
- systems-foundations / text processing pipelines
- sec-writeups-public / SOC Fundamentals
- GitHub: @stacknil
- Site: stacknil.github.io
- Email: stacknil@proton.me


