Security architecture without working code is just theory. In enterprise defense and application security, the most resilient architectures are those reinforced by automated guardrails, mathematical boundary enforcement, and deterministic tooling.
This portfolio showcases open-source projects, DevTools extensions, detection engineering utilities, and containerized labs authored by Joshua A. Wortz, CISSP under the Code and Cypher engineering banner.
Unified Client-to-Server Security Reconnaissance & Safe Harbor Verification
A two-stage offensive reconnaissance and defensive verification pipeline pairing StateHunter (browser DevTools client inspection) with AuditGuard (terminal boundary enforcement and safe harbor certification).
Discovers hidden SPA routes, audits runtime postMessage sinks, detects in-memory secrets, and exports scope YAML.
Enforces mathematical scope guardrails, audits dual-role IDOR matrices, executes Nuclei YAML checks, and generates Safe Harbor SOWs.
Universal, platform-agnostic, zero-trust static publishing engine with automated DevSecOps gates.
A production-grade, zero-trust static publishing framework featuring automated Gitleaks secret scanning, 33+ headless Python DevSecOps quality gates, shift-left CLI tooling, RFC 9116 security.txt validation, and pluggable edge deployment adapters.
git clone https://github.com/SixFiveMil/hugo-devsecops-starter.gitCompliance-First Scope Enforcement & Audit Automation Framework
A terminal framework designed for authorized security research under VDP and bug bounty engagements. Mathematically prevents out-of-scope network traffic, executes Nuclei-compatible YAML diagnostics, audits dual-role authorization matrices (IDOR/BOLA), calculates FIRST.org CVSS v3.1 scores, and generates Disclose.io Safe Harbor proof-of-adherence certificates.
pip install auditguardIn-Browser SPA State & DOM Security Reconnaissance
A high-performance Chrome Manifest V3 DevTools extension for application security engineers and penetration testers. Performs real-time client-side runtime JS analysis, de-obfuscates hidden Next.js/Nuxt/Remix chunk manifests, audits and replays postMessage handlers, detects in-memory secrets and high-entropy keys, and exports directly to AuditGuard YAML.
git clone https://github.com/SixFiveMil/statehunter.gitLog Analytics Schema Discovery & Sentinel Rule Coverage Auditor
Enterprise discovery and audit utility for Microsoft Sentinel and Azure Log Analytics. Discovers table schemas, auto-resolves ARM workspace hierarchies, cross-references deployed analytics rules against Content Hub solution templates, and outputs phased, risk-prioritized rule enablement plans.
git clone https://github.com/SixFiveMil/Sentinel-Inventory.git && pip install -r requirements.txtModel Context Protocol Server for WordPress Publishing
A production-grade Model Context Protocol (MCP) server enabling Claude, Gemini, and agentic AI systems to securely query, draft, review, and publish technical publications via the WordPress REST API.
git clone https://github.com/SixFiveMil/wp-mcp-server.git && docker compose up -dHands-On Local LLM Prompt Injection & Defense Lab
A containerized Red Team / Blue Team lab designed for teaching practical LLM defenses. Uses Docker Compose, local Ollama models, and a Python security gateway to demonstrate the necessity of layered defense-in-depth against prompt injection and data exfiltration.
git clone https://github.com/SixFiveMil/Securing-AI.git && docker compose up -dAutomated Cryptanalysis & Stochastic Hill-Climbing Decoder
Pure Python 3 cryptanalysis tool implementing frequency analysis, stochastic hill-climbing optimization, and Kasiski / Index of Coincidence analysis to break mono-alphabetic and poly-alphabetic ciphers.
git clone https://github.com/SixFiveMil/decoding.git && python decoding.pyHybrid local-first bridge syncing Canvas LMS courses, grades, files, and discussions into Obsidian.
Bridges academic coursework directly from Canvas LMS into Obsidian as clean, linked Markdown notes. Features a decoupled hybrid architecture pairing an official guidelines-compliant Obsidian plugin with a standalone Manifest V3 browser extension. Supports direct Canvas REST API syncing (Desktop & Mobile) and zero-token browser extraction for locked-down institutions. Validated with official obsidianmd/obsidian-workflows, SLSA build provenance attestations, and 100% zero-telemetry local execution.
git clone https://github.com/SixFiveMil/obsidian-canvas-sync.git && npm installMulti-browser Manifest V3 companion extension for zero-token session course extraction.
Standalone Manifest V3 browser extension for Chrome, Brave, Edge, Arc, and Firefox. Extracts authenticated Canvas LMS course hierarchies, syllabi, assignments, grades, and discussion trees directly from active browser session cookies without requiring administrative API tokens. Bridges data securely over link-local loopback (127.0.0.1:27125) into Obsidian.
git clone https://github.com/SixFiveMil/canvas-to-obsidian-extension.git && npm install