Things I've built

The modern, open-source CTF platform. After years of running an international competition on a patchwork of plugins, Discord bots and spreadsheets, I built the platform I wanted to exist: one self-hosted system that handles the whole lifecycle of a CTF.

• Real-time everything — WebSocket-driven scoreboards, presence and notifications, with public spectator boards built for projection.
• A visual automation engine — no-code rules that trigger announcements, hints, score adjustments and board freezes on time or event conditions.
• CRDT-backed collaborative notes on every challenge, so teams work together without a separate doc.
• A built-in support desk — ticket queues, staff assignment and private notes, the feature CTFs always improvise badly.
• Dynamic decay scoring, prerequisites, scheduled releases, deep role-based permissions, CTFtime-compatible feeds.

Self-hosted via Docker, AGPL-3.0 licensed, and your competition data lives in your Postgres — yours forever.

An adversarial testing harness for LLM features embedded in hostile, multi-user applications. Born from putting an AI assistant into Flagpost. Most "AI security" testing checks whether a model refuses a bad request — FalsePrompt doesn't care whether it refuses. It tests defence by construction: the pass condition is that the model never had access to the gated data in the first place, so even a fully jailbroken assistant has nothing to leak.

• Every test asserts against an authorization boundary. Leaks are verified programmatically — did the known-secret string actually appear in the output? — never judged by asking another model whether something looks leaked.
• Categorised, pluggable threat suites: direct extraction, indirect and stored injection, cross-boundary context bleed, tool and agent abuse, and resource abuse.
• Test cases as data (YAML/JSON), pluggable target adapters, machine-readable reports, and an exit code that reflects pass/fail — the headline use case is failing a pull-request build if the flag-leak rate is anything but zero.

Early design and scaffolding — interfaces, categories and the scoring model will change. Watch the repo to follow along.

Before Flagpost there was this: a CTFd plugin that adds a proper support ticket system for remote competitions. Participants submit tickets and attach screenshots; admins triage and respond inside the platform instead of chasing DMs. Battle-tested on a 1,900-player event.

The site you're reading. A fully static Astro build with a hand-rolled Three.js glitch engine: a ping-pong feedback buffer smears the hero type with block-quantised displacement (the datamosh effect), presented with RGB channel separation — and a decoy 2009-grade homepage that gets taken over on arrival. No trackers, no analytics, no cookies; served as static assets from Cloudflare's edge with strict security headers.