Projects

Things I built to prove a point

Most of these started the same way: a conversation where the honest answer was "I think so — let me go check." Two of them turned into products. All of them are public.

The pipeline is the attack surface nobody scans.

Product 2026 Live

GitHub Actions
GitLab CI
OWASP CI/CD Top-10

Pipefort

Everyone hardens the app and leaves the pipeline wide open — the place with the credentials, the artifacts and the push access. Pipefort scans CI/CD configuration the way a static analyser scans code, and it doesn't guess.

74 deterministic rules covering the OWASP CI/CD Top-10 — no model in the loop, so the same repo gives the same answer twice.
Attack-chain analysis: individually-minor findings get linked into the path an attacker would actually walk.
Auto-fixes for GitHub Actions and GitLab CI, so the finding arrives with the patch attached.
Any public GitHub repo can be scanned free, no sign-up — the fastest way to see whether your pipeline holds.

Scan a repo ↗

A privacy policy is a promise. An absent network call is a fact.

Product 2026 Shipping

Swift
Core ML
Neural Engine
macOS 14+

Lousa

Every dictation app on the market solves the problem by sending your voice to someone's datacenter. A privacy policy is a promise; an absent network call is a fact. Lousa has no server, so there's no breach to have.

Hold a key and speak — transcription and cleanup both run on the Apple Neural Engine, and the finished sentence lands at your cursor in whatever app you were already in.
A local model tidies as it goes: fillers out, commas in, tone matched to the app you are typing into. Say "scratch that" and it takes the last bit back.
A custom dictionary for the words only you say — product names, medications, colleagues whose names nothing spells right.
Bought, not rented: $19.99 once, license key by email, no account and no dashboard to log into.

Download for Mac ↗ Buy Lousa Pro ↗

You can't cover agentic security from one side of it.

Newsletter Since 2025 Hundreds of subscribers

Substack
Agentic AI
Offense & defense

Agentic Security

Autonomous agents are changing both sides of security at once — the pentest and the perimeter. Most coverage picks a side or picks a vendor. This picks the week apart.

Each issue works through the tactics, tools and research actually defining agentic security, rather than the announcements.
Covers offense and defense together, because the same capability shows up on both sides within a month.
Free, and it is where most of my current thinking lands first.

Read the newsletter ↗

Security advice shouldn't have to be translated twice.

Podcast Since 2025 Ongoing, in Portuguese

Portuguese
Cloud security
With Tales Casagrande

A Culpa é de Sec

Brazilian security conversations usually get translated twice: once from English, once from marketing. Tales and I record the version we would have wanted — two practitioners arguing about cloud security in our own language.

Episodes work through one real topic at a time — shared responsibility, CSPM, whatever we cannot agree on that month.
No sponsor script, no vendor framing, and no pretending either of us has it fully figured out.
On Spotify and Apple Podcasts.

Listen on Spotify ↗ On Apple Podcasts ↗

If nobody is tracking the field, start the list.

Open source 2025 538 stars · 105 forks

Community-maintained
MIT

Awesome Cybersecurity Agentic AI

The field moved faster than anyone could track, so I started the list. It has since become one of the reference indexes for security-focused agentic AI, maintained by the community that uses it.

MCP servers, scanners, frameworks, research papers and datasets — curated, described, and kept current.
538 stars, 105 forks, 81 commits and a steady queue of community pull requests.
MIT licensed with contribution guidelines, because a list nobody can add to goes stale in a quarter.

Browse the list ↗

You can't defend against an attack you've never run.

Open source 2025 Maintained

Python
Boto3
CloudFormation
Step Functions

S3 Ransomware Simulator

A new class of ransomware only exists because of the cloud: an attacker with write access rewrites your S3 objects using customer-provided keys (SSE-C), and AWS never stores the key. Plenty of people wrote about the attack. I wanted something you could run against your own account to find out whether you'd survive it.

Enumerates buckets, checks read/write permissions, then re-encrypts every object in place with an AES-256 key only the attacker holds — the same CopyObject trick a real campaign uses.
Ships the detection as CloudFormation: a CloudTrail trail with advanced event selectors narrowed to CopyObject data events, so it stays cheap enough to run at scale.
Ships the response too — a Step Functions state machine that reads the identity type off the CloudTrail event and quarantines the IAM user or assumed role automatically.
Includes the prevention side: bucket policies that deny SSE-C uploads and CopyObject outright, plus object versioning with DeleteObjectVersion locked down.

View the repo ↗ Read the writeup ↗

A check that runs after you've moved on runs too late.

Developer tool 2023 Built at Trend Micro

TypeScript
VS Code API
CloudFormation

Conformity Template Scanner

Misconfiguration is the most boring way to get breached, and by the time a pipeline catches it you have already context-switched three times. This extension moves the check to where the mistake is made: the editor.

Scans CloudFormation templates against Conformity rules as you write them, inline in VS Code.
Surfaces the failing rule and the fix next to the offending line — no dashboard round-trip.
Published on the VS Code Marketplace and used well outside the team that built it.

Get the extension ↗

The signal is worth automating. The firehose isn't.

Bot 2023 Running daily

Python
AWS Lambda
EventBridge

Daily AWS News Bot

AWS ships hundreds of announcements a year and the official feed is a firehose. I wanted the signal without the feed, so I built the thing that reads it for me and posts what actually matters.

Pulls the AWS announcement feed, filters the noise, and posts on a schedule — fully serverless, no server to forget about.
Has run unattended since 2023.

Follow @dailyawsnews ↗

Small tools are how you keep the pipeline warm.

Bot 2023 Running daily

Python
AWS Lambda
EventBridge

Daily AWS Tips Bot

The sibling project: one practical AWS tip a day, automated end to end. Small, useful, and a good excuse to keep the pipeline warm.

A curated tip queue posted on a schedule, same serverless backbone as the news bot.
Built in an afternoon; still running years later, which is the point.

Follow @dailyawstips ↗

The writing behind them

Writing

9 articles on cloud ransomware, vulnerability triage and the boring misconfigurations that end companies.

Read →

Talks

The same projects, on stage: re:Invent, AWS Summits NYC and LA, DevOps Connect.

See the stages →

Got something to build?

raphabot@gmail.com

← Back home