skeletonsec is online

This site is live. skeletonsec — my research lab — now has a front door that isn’t a GitHub profile page. Static HTML, system fonts, no trackers, no JavaScript. View source; that is the stack.

What gets published here

Three kinds of posts:

• Vulnerability research. 0/1/N-day work — root cause, the primitive, the exploit path, the fix. Patch-diff and variant-analysis notes when a disclosed fix is more instructive than the advisory.
• CTF writeups. Organized by event as series — recon, the bug, exploitation, flag, lessons. The ones where I lost hours to a stupid assumption are the most worth writing down, so those get written first.
• Tool design notes. Why a tool is built the way it is, with benchmarks and the mistakes that shaped it.

The rule

Everything here answers to one doctrine: claims carry evidence. A bug without a reproducer is a rumor. A benchmark without a method section is marketing. If I can’t show you the request pair, the crashing input, or the script, the post doesn’t ship. Expect every writeup to end with something you can run.

The tools

Two open-source projects live under the lab and will get design notes here:

• authprobe — authenticated-session record/refresh/export for DAST. Shipped, and the first design-notes post is already outlined.
• skelet0n — a staged research conductor with a tamper-evident evidence ledger. Phase 0: the engine and ledger are real; swarm and local RAG are Phase 2 and I’ll say so on the tin.

Cadence

Writeups land when the work is done — with reproducers. No schedule, no filler. The RSS feed and github.com/skeletonsec are the ways to know when something lands.