Notes from a cybersecurity practice, kept in the open.

I am isaac wong. I am learning security the slow way: read the protocol, build the thing, break the thing, then write down what actually held.

This archive is where that work gets recorded as it happens. Notes track progress and small findings. Releases will point at finished, signed software. Guides will be the canonical documentation for anything I end up maintaining, so a repository can link back here instead of keeping a second copy of the instructions.

The archive opens with a single record, and it grows only when there is something real to file. Everything published here is written after the fact, from work I am free to talk about. Anything under coordinated disclosure stays unpublished until it is resolved and clearance is explicit.

What is published

Notes record progress and small findings, dated to the month. Releases point at finished, signed software and carry an exact date. Guides are canonical documentation for tooling I maintain, so a repository can link back here rather than keeping a second copy of the instructions. Categories with no records yet simply have none.

Disclosure

Vulnerability research is published only after coordinated disclosure has concluded and publication is permitted. Until then it does not appear here in any form, including as a hint that it exists.

Privacy

This site sets no cookies, runs no analytics, loads no third-party scripts, embeds nothing, and requests no external fonts — the two typefaces are bundled with the site. Nothing you do here is recorded by me.

Published material carries no addresses, hostnames, account names, institutions or locations. Images are stripped of metadata and re-encoded before they are committed, and an automated scan runs over the source and the built output before every release.

Contact

There is no public address yet. Until a dedicated one exists, the honest answer is that there is no inbox to point you at — open an issue on the relevant repository on GitHub instead.