Policy engine for proxy-wasm. ~60 KB wasm, written in Zig.

Every skill you install says trust me bro. This one reads it first. Pre-install audit for agent skills, plugins, and MCP servers: lethal-trifecta reach, injection wording, provenance, and drift aft…

Engineering laws, principles and mental models for software developers — each with its counter-force, a field guideline, and a primary source. English / 日本語.

Identity, Authorization & Cloud Native Security — a data-driven profile page (selected work, upstream contributions, 0-draft), auto-synced from the GitHub API.

MCP server giving LLM agents real authorization answers: evaluate Rego in-process via OPA, or ask an OpenID AuthZEN 1.0 PDP

My GitHub profile README. A shogi board anyone can play, one issue per move, plus a guest book.

A terminal user interface (TUI) tool for viewing and analyzing X.509 certificate chains

Cost calculator for offline password brute-force attacks: time + USD per GPU profile, with a CI gatekeeper.

This repository contains an extended version of OPA (OPA-AuthZEN) that implements the OpenID AuthZEN Authorization API 1.0.

GitHub Action for brtc — gate CI on offline password brute-force cost (time + USD, optional SARIF).

kanywst's Homebrew tap — CLI tools with SBOMs and cosign-signed releases

SPIFFE-compatible workload identity + OpenID AuthZEN 1.0 authorization in a single Apache-2.0 binary. Cedar PDP, SPIFFE federation, tamper-evident audit log, Kubernetes operator.

Track your VS Code extensions in git and reinstall the same set on any machine.

A readable map of the cloud native ecosystem: history, architecture, adoption, and code internals for every CNCF project. English and 日本語.

OPA + Rego PDP implementation for the OpenID AuthZEN interop Todo scenario.

You start with a login form. You end with 14 identity providers and a service mesh. A satirical scrollytelling essay on modern auth/authz.

Authorization and access control tools, frameworks, standards, and resources.

Static MUST-clause compliance checker for SPIFFE artifacts (SPIFFE-ID, X.509-SVID, JWT-SVID, Trust Bundle). Each failure cites the spec section.

Every AWS bill is three meters: Time, Bytes, Units. 253 services classified against them, each with the trap people hit, the usage type to search for, and a dated AWS source.

A vendor-neutral WIMSE (Workload Identity in Multi System Environments) reference implementation in Rust — WIT, WPT, RFC 9421 HTTP signatures, and mTLS/WIC.

A visual timeline of IT history, exploring the founding dates and origins of major tech companies, web services, programming languages, and operating systems.

Live, visual network-path diagnostic that pinpoints exactly where your Wi-Fi connection dies — and how to fix it. Rust + ratatui TUI.

A sophisticated movie tracking SPA

Modern macOS dev environment — zsh + stow + starship + atuin + mise + nix-darwin, no plugin manager

Run Claude Code as an A2A protocol agent server — tool progress, file diffs, and permission prompts mapped onto the A2A protocol.