--- title: "Open-Source Projects & Security Tooling" canonical: "https://codeandcypher.com/projects/" description: "Production-grade cybersecurity tools, AppSec automation, detection utilities, and educational labs by Joshua Wortz." --- # Open-Source Projects & Security Tooling > Production-grade cybersecurity tools, AppSec automation, detection utilities, and educational labs by Joshua Wortz. Security architecture without working code is just theory. In enterprise defense and application security, the most resilient architectures are those reinforced by automated guardrails, mathematical boundary enforcement, and deterministic tooling. This portfolio showcases open-source projects, DevTools extensions, detection engineering utilities, and containerized labs authored by **Joshua A. Wortz, CISSP** under the **[Code and Cypher](https://codeandcypher.com)** engineering banner. ## Code & Cypher Application Security Suite > Unified Client-to-Server Security Reconnaissance & Safe Harbor Verification A two-stage offensive reconnaissance and defensive verification pipeline pairing StateHunter (browser DevTools client inspection) with AuditGuard (terminal boundary enforcement and safe harbor certification). ## Open-Source Projects & Tooling ### Hugo DevSecOps Starter (Production Stable) - **Tagline**: Universal, platform-agnostic, zero-trust static publishing engine with automated DevSecOps gates. - **Category**: DevSecOps & CI/CD - **Repository**: https://github.com/SixFiveMil/hugo-devsecops-starter - **Documentation**: https://github.com/SixFiveMil/hugo-devsecops-starter#readme - **Installation**: `git clone https://github.com/SixFiveMil/hugo-devsecops-starter.git` - **Tech Stack**: Hugo Extended, Python 3.10+, GitHub Actions, Gitleaks, Cloudflare Pages, RFC 9116, WCAG 2.1 AA A production-grade, zero-trust static publishing framework featuring automated Gitleaks secret scanning, 33+ headless Python DevSecOps quality gates, shift-left CLI tooling, RFC 9116 security.txt validation, and pluggable edge deployment adapters. **Key Highlights:** - 33+ automated headless Python security and functional quality gates - Zero-token platform-agnostic reusable verification workflow (workflow_call) - Shift-left pre-push Git hook preventing draft, secret, and path leakage - Automated IndexNow search engine indexing and RFC 9116 security.txt enforcement --- ### AuditGuard (Production Stable) - **Tagline**: Compliance-First Scope Enforcement & Audit Automation Framework - **Category**: Application Security - **Repository**: https://github.com/SixFiveMil/auditguard - **Documentation**: https://github.com/SixFiveMil/auditguard/blob/main/docs/ARCHITECTURE.md - **Installation**: `pip install auditguard` - **Tech Stack**: Python 3.9+, Nuclei YAML, CVSS v3.1, Disclose.io Safe Harbor, Token-Bucket Rate Limiting A terminal framework designed for authorized security research under VDP and bug bounty engagements. Mathematically prevents out-of-scope network traffic, executes Nuclei-compatible YAML diagnostics, audits dual-role authorization matrices (IDOR/BOLA), calculates FIRST.org CVSS v3.1 scores, and generates Disclose.io Safe Harbor proof-of-adherence certificates. **Key Highlights:** - Deterministic mathematical scope enforcement (CIDR, regex, path exclusions) - Native execution of ProjectDiscovery Nuclei HTTP diagnostic templates - Dual-role IDOR / BOLA authorization matrix prober - 1-click export to HackerOne, Bugcrowd (VRT), and Jira Cloud --- ### StateHunter (Production Stable) - **Tagline**: In-Browser SPA State & DOM Security Reconnaissance - **Category**: Application Security - **Repository**: https://github.com/SixFiveMil/statehunter - **Documentation**: https://github.com/SixFiveMil/statehunter/blob/main/docs/ARCHITECTURE.md - **Installation**: `git clone https://github.com/SixFiveMil/statehunter.git` - **Tech Stack**: TypeScript 5.8, React 19, Chrome Manifest V3, Tailwind CSS, Vitest A high-performance Chrome Manifest V3 DevTools extension for application security engineers and penetration testers. Performs real-time client-side runtime JS analysis, de-obfuscates hidden Next.js/Nuxt/Remix chunk manifests, audits and replays postMessage handlers, detects in-memory secrets and high-entropy keys, and exports directly to AuditGuard YAML. **Key Highlights:** - De-obfuscates unlinked routes from Next.js, Remix, Nuxt, and Webpack chunks - Hooks window.addEventListener("message") to detect dangerous DOM sinks - Scans window.* globals and localStorage for leaked API keys and JWT claims - 1-click export to AuditGuard scope YAML and formatted Markdown bug reports --- ### Sentinel-Inventory (Reference Implementation) - **Tagline**: Log Analytics Schema Discovery & Sentinel Rule Coverage Auditor - **Category**: Cloud SIEM & Detection Engineering - **Repository**: https://github.com/SixFiveMil/Sentinel-Inventory - **Documentation**: https://github.com/SixFiveMil/Sentinel-Inventory/blob/main/RUNBOOK.md - **Installation**: `git clone https://github.com/SixFiveMil/Sentinel-Inventory.git && pip install -r requirements.txt` - **Tech Stack**: Python 3, Azure SDK, KQL / Kusto, ARM REST API, PowerShell Enterprise discovery and audit utility for Microsoft Sentinel and Azure Log Analytics. Discovers table schemas, auto-resolves ARM workspace hierarchies, cross-references deployed analytics rules against Content Hub solution templates, and outputs phased, risk-prioritized rule enablement plans. **Key Highlights:** - Automated discovery of Log Analytics tables, schema definitions, and normalized types - Auto-resolves Azure resource hierarchy from workspace GUID without manual inputs - Intelligent fallback to GitHub search API when Content Hub is regionally unavailable - Generates tactical, phased CSV enablement plans ranked by MITRE ATT&CK tactics --- ### WordPress MCP Server (Production Stable) - **Tagline**: Model Context Protocol Server for WordPress Publishing - **Category**: Agentic AI & Infrastructure - **Repository**: https://github.com/SixFiveMil/wp-mcp-server - **Documentation**: https://github.com/SixFiveMil/wp-mcp-server/blob/main/QUICK_REFERENCE.md - **Installation**: `git clone https://github.com/SixFiveMil/wp-mcp-server.git && docker compose up -d` - **Tech Stack**: Python 3.10+, Docker Compose, Model Context Protocol, WordPress REST API A production-grade Model Context Protocol (MCP) server enabling Claude, Gemini, and agentic AI systems to securely query, draft, review, and publish technical publications via the WordPress REST API. **Key Highlights:** - Full support for post creation, metadata tagging, status toggling, and categories - Containerized Docker Compose deployment for zero-leak local execution - Compliant with the official Anthropic Model Context Protocol specification - Includes detailed contributing guidelines, changelog, and sharing guides --- ### Securing-AI Sandbox (Educational Lab) - **Tagline**: Hands-On Local LLM Prompt Injection & Defense Lab - **Category**: AI Security & Education - **Repository**: https://github.com/SixFiveMil/Securing-AI - **Documentation**: https://github.com/SixFiveMil/Securing-AI#readme - **Installation**: `git clone https://github.com/SixFiveMil/Securing-AI.git && docker compose up -d` - **Tech Stack**: Docker, Ollama (Llama 3.2), Open Policy Agent (Rego), Python 3 A containerized Red Team / Blue Team lab designed for teaching practical LLM defenses. Uses Docker Compose, local Ollama models, and a Python security gateway to demonstrate the necessity of layered defense-in-depth against prompt injection and data exfiltration. **Key Highlights:** - Phase 1: Model hardening via defensive system prompt engineering - Phase 2: Programmatic ingress/egress filtering via Python gateway - Phase 3: Formal policy enforcement using Open Policy Agent (OPA) and Rego - Runs entirely on modest local hardware (8GB laptops) with zero cloud API bills --- ### decoding Engine (Educational Lab) - **Tagline**: Automated Cryptanalysis & Stochastic Hill-Climbing Decoder - **Category**: Applied Cryptography - **Repository**: https://github.com/SixFiveMil/decoding - **Documentation**: https://github.com/SixFiveMil/decoding#readme - **Installation**: `git clone https://github.com/SixFiveMil/decoding.git && python decoding.py` - **Tech Stack**: Python 3, Applied Mathematics, Stochastic Optimization, CLI Pure Python 3 cryptanalysis tool implementing frequency analysis, stochastic hill-climbing optimization, and Kasiski / Index of Coincidence analysis to break mono-alphabetic and poly-alphabetic ciphers. **Key Highlights:** - Automated mono-alphabetic substitution cracking via frequency analysis - Multi-restart stochastic hill-climbing swap search to optimize plaintext readability - Poly-alphabetic (Vigenère) key recovery using Kasiski examination and IC slicing - Zero external dependencies—pure Python standard library --- ### Canvas to Obsidian Sync (Active Beta) - **Tagline**: Hybrid local-first bridge syncing Canvas LMS courses, grades, files, and discussions into Obsidian. - **Category**: PKM & Knowledge Management - **Repository**: https://github.com/SixFiveMil/obsidian-canvas-sync - **Documentation**: https://github.com/SixFiveMil/obsidian-canvas-sync/blob/main/docs/ARCHITECTURE.md - **Installation**: `git clone https://github.com/SixFiveMil/obsidian-canvas-sync.git && npm install` - **Tech Stack**: TypeScript 5.8, Obsidian Desktop & Mobile API, WebExtensions (Manifest V3), obsidian-workflows, SLSA Build Provenance, Turndown & GFM Tables, Vitest & esbuild Bridges academic coursework directly from Canvas LMS into Obsidian as clean, linked Markdown notes. Features a decoupled hybrid architecture pairing an official guidelines-compliant Obsidian plugin with a standalone Manifest V3 browser extension. Supports direct Canvas REST API syncing (Desktop & Mobile) and zero-token browser extraction for locked-down institutions. Validated with official obsidianmd/obsidian-workflows, SLSA build provenance attestations, and 100% zero-telemetry local execution. **Key Highlights:** - Hybrid ingestion supporting Direct Canvas REST API (Desktop & Mobile) and zero-token browser extension. - Decoupled standalone repositories for Obsidian Plugin and WebExtension with independent release lifecycles. - Full Obsidian Community compliance with official obsidian-workflows, popout window safety, and SLSA provenance. - Comprehensive coursework sync including Grades (Grades.md), Discussions (nested reply trees), Tasks, Calendar, and Rubrics. --- ### Canvas to Obsidian Extension (Active Beta) - **Tagline**: Multi-browser Manifest V3 companion extension for zero-token session course extraction. - **Category**: PKM & Knowledge Management - **Repository**: https://github.com/SixFiveMil/canvas-to-obsidian-extension - **Documentation**: https://github.com/SixFiveMil/canvas-to-obsidian-extension#readme - **Installation**: `git clone https://github.com/SixFiveMil/canvas-to-obsidian-extension.git && npm install` - **Tech Stack**: TypeScript 5.8, Chrome Manifest V3, Firefox WebExtensions, Service Workers, Vitest & esbuild Standalone Manifest V3 browser extension for Chrome, Brave, Edge, Arc, and Firefox. Extracts authenticated Canvas LMS course hierarchies, syllabi, assignments, grades, and discussion trees directly from active browser session cookies without requiring administrative API tokens. Bridges data securely over link-local loopback (127.0.0.1:27125) into Obsidian. **Key Highlights:** - Zero-token session scraping bypassing administrative Canvas API restrictions - Granular popup extraction toggles for modules, grades, discussions, and files - Hardened loopback client with mandatory X-Canvas-Sync-Client headers - Automated deployment pipeline for Chrome Web Store and Firefox AMO ---