● Zion Boggan
repos/Security Portfolio/index.html
zionboggan.com ↗
Code Commits Tags
543 lines · html
History for this file →
1
<!doctype html>
2
<html lang="en">
3
<head>
4
<meta charset="utf-8">
5
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6
<title>Zion Boggan | Security Engineering, Detection Engineering, and Research</title>
7
<meta name="description" content="Zion Boggan, SOC analyst and independent security researcher. Detection engineering, vulnerability research, and applied cryptography, including Oversight Protocol, a post-quantum data-provenance system in Rust.">
8
<meta name="author" content="Zion Boggan">
9
<meta name="robots" content="index, follow, max-image-preview:large, max-snippet:-1">
10
<link rel="canonical" href="https://zionboggan.com/">
11
<meta property="og:type" content="profile">
12
<meta property="og:site_name" content="Zion Boggan">
13
<meta property="og:title" content="Zion Boggan | Security Engineering, Detection Engineering & Research">
14
<meta property="og:description" content="SOC analyst and independent security researcher. Vulnerability research with full proof-of-concept exploits, detection engineering, and applied cryptography.">
15
<meta property="og:url" content="https://zionboggan.com/">
16
<meta property="og:image" content="https://zionboggan.com/assets/og-default.png">
17
<meta property="og:image:alt" content="Zion Boggan: Security Engineering & Research">
18
<meta property="profile:first_name" content="Zion">
19
<meta property="profile:last_name" content="Boggan">
20
<meta name="twitter:card" content="summary_large_image">
21
<meta name="twitter:title" content="Zion Boggan | Security Engineering, Detection Engineering & Research">
22
<meta name="twitter:description" content="SOC analyst and independent security researcher. Vulnerability research, detection engineering, and applied cryptography.">
23
<meta name="twitter:image" content="https://zionboggan.com/assets/og-default.png">
24
<script type="application/ld+json">
25
{
26
  "@context": "https://schema.org",
27
  "@type": "Person",
28
  "name": "Zion Boggan",
29
  "givenName": "Zion",
30
  "familyName": "Boggan",
31
  "url": "https://zionboggan.com/",
32
  "image": "https://zionboggan.com/assets/og-default.png",
33
  "email": "mailto:zionboggan0@gmail.com",
34
  "jobTitle": "Security Researcher & Detection Engineer",
35
  "description": "SOC analyst and independent security researcher specializing in vulnerability research, detection engineering, and applied cryptography.",
36
  "knowsAbout": ["Vulnerability Research", "Detection Engineering", "SOC Analysis", "Applied Cryptography", "Threat Detection", "Security Engineering"],
37
  "sameAs": [
38
    "https://www.linkedin.com/in/zion-boggan",
39
    "https://oversightprotocol.dev"
40
  ]
41
}
42
</script>
43
<script type="application/ld+json">
44
{
45
  "@context": "https://schema.org",
46
  "@type": "WebSite",
47
  "name": "Zion Boggan",
48
  "url": "https://zionboggan.com/",
49
  "author": { "@type": "Person", "name": "Zion Boggan" }
50
}
51
</script>
52
53
54
55
<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='6' fill='%230c0e12'/%3E%3Ctext x='16' y='22' font-family='monospace' font-size='15' fill='%236cc7b8' text-anchor='middle'%3Ezb%3C/text%3E%3C/svg%3E">
56
<style>
57
  :root{
58
    --bg:#0c0e12; --bg2:#0f1217; --panel:#14181f; --panel2:#171c24;
59
    --line:#222936; --line2:#2c3543;
60
    --ink:#e8eaed; --soft:#c3cad4; --muted:#8a94a3; --faint:#5d6675;
61
    --accent:#6cc7b8; --accent-dim:#274b47;
62
    --maxw:1020px;
63
  }
64
  *{box-sizing:border-box;}
65
  html{scroll-behavior:smooth;}
66
  body{margin:0;background:var(--bg);color:var(--ink);
67
    font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
68
    font-size:16px;line-height:1.65;-webkit-font-smoothing:antialiased;}
69
  .mono{font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,monospace;}
70
  a{color:var(--accent);text-decoration:none;}
71
  a:hover{color:#8fe0d2;}
72
  .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px;}
73
74
  /* nav */
75
  nav{position:sticky;top:0;z-index:20;background:rgba(12,14,18,.82);
76
    backdrop-filter:blur(10px);border-bottom:1px solid var(--line);}
77
  nav .wrap{display:flex;align-items:center;justify-content:space-between;height:58px;}
78
  nav .brand{font-weight:600;letter-spacing:.2px;}
79
  nav .brand .dot{color:var(--accent);}
80
  nav .links{display:flex;gap:26px;font-size:13.5px;}
81
  nav .links a{color:var(--muted);}
82
  nav .links a:hover{color:var(--ink);}
83
  @media(max-width:680px){nav .links{display:none;}}
84
85
  /* hero */
86
  header.hero{padding:74px 0 54px;border-bottom:1px solid var(--line);
87
    background:radial-gradient(900px 380px at 78% -10%, #11201e 0%, transparent 60%);}
88
  .avail{font-size:12.5px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);
89
    display:flex;align-items:center;gap:9px;margin-bottom:20px;}
90
  .avail .pulse{width:7px;height:7px;border-radius:50%;background:var(--accent);
91
    box-shadow:0 0 0 0 rgba(108,199,184,.5);animation:p 2.4s infinite;}
92
  @keyframes p{0%{box-shadow:0 0 0 0 rgba(108,199,184,.45)}70%{box-shadow:0 0 0 8px rgba(108,199,184,0)}100%{box-shadow:0 0 0 0 rgba(108,199,184,0)}}
93
  h1{font-size:clamp(34px,6vw,52px);line-height:1.05;margin:0 0 8px;letter-spacing:-1px;font-weight:680;}
94
  .hero .sub{font-size:clamp(16px,2.4vw,20px);color:var(--soft);margin:0 0 24px;font-weight:500;}
95
  .hero .lede{max-width:660px;color:var(--soft);font-size:17px;margin:0 0 28px;}
96
  .hero .lede b{color:var(--ink);font-weight:600;}
97
  .cta{display:flex;flex-wrap:wrap;gap:12px;align-items:center;}
98
  .btn{display:inline-flex;align-items:center;gap:8px;padding:10px 18px;border-radius:8px;
99
    font-size:14.5px;font-weight:550;border:1px solid var(--line2);color:var(--ink);background:var(--panel);}
100
  .btn:hover{border-color:var(--accent-dim);background:var(--panel2);color:var(--ink);}
101
  .btn.primary{background:var(--accent);color:#06231f;border-color:var(--accent);font-weight:650;}
102
  .btn.primary:hover{background:#8fe0d2;color:#06231f;}
103
  .meta{margin-top:26px;display:flex;flex-wrap:wrap;gap:8px 22px;font-size:13px;color:var(--muted);}
104
  .meta .mono{color:var(--faint);}
105
106
  /* proof / live-exploit demo */
107
  .proof{padding-top:48px;}
108
  .proof-intro{max-width:760px;color:var(--soft);font-size:15.5px;line-height:1.6;margin:0 0 28px;}
109
  .demo{border:1px solid var(--line2);border-radius:12px;overflow:hidden;background:#0a0c10;
110
    box-shadow:0 0 0 1px rgba(108,199,184,.08), 0 26px 64px -28px rgba(0,0,0,.75);}
111
  .demo + .demo{margin-top:30px;}
112
  .step{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.6px;color:#06231f;
113
    background:var(--accent);padding:2px 8px;border-radius:5px;margin-right:9px;vertical-align:1px;}
114
  .step.crit{background:#ff6b6b;color:#2a0606;}
115
  .demobar{display:flex;align-items:center;gap:8px;padding:11px 14px;background:#11151b;border-bottom:1px solid var(--line);}
116
  .demobar .d{width:11px;height:11px;border-radius:50%;}
117
  .demobar .r{background:#ff5f57;}.demobar .y{background:#febc2e;}.demobar .g{background:#28c840;}
118
  .demobar .dlabel{color:var(--faint);font-size:12.5px;margin-left:8px;}
119
  .demobar .dbadge{margin-left:auto;color:#06231f;background:var(--accent);font-size:11px;font-weight:700;
120
    padding:3px 9px;border-radius:5px;letter-spacing:.5px;}
121
  .demobar .dbadge.alt{background:#7aa2f7;color:#06122a;}
122
  .demovid{display:block;width:100%;height:auto;background:#0a0c10;cursor:pointer;}
123
  .democap{margin:0;padding:15px 18px;color:var(--soft);font-size:14px;line-height:1.55;
124
    background:var(--panel);border-top:1px solid var(--line);}
125
  .democap b{color:var(--ink);font-weight:600;}
126
127
  /* sections */
128
  section{padding:64px 0;border-bottom:1px solid var(--line);}
129
  .shead{display:flex;align-items:baseline;gap:14px;margin-bottom:30px;}
130
  .shead .idx{font-size:13px;color:var(--accent);letter-spacing:1px;}
131
  .shead h2{font-size:14px;letter-spacing:2px;text-transform:uppercase;color:var(--muted);margin:0;font-weight:600;}
132
  .shead .rule{flex:1;height:1px;background:var(--line);}
133
134
  /* flagship */
135
  .flag{background:linear-gradient(180deg,var(--panel) 0%,var(--bg2) 100%);
136
    border:1px solid var(--line2);border-radius:14px;overflow:hidden;}
137
  .flag .top{padding:30px 32px 8px;}
138
  .flag .tag{font-size:12px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);margin-bottom:12px;}
139
  .flag h3{font-size:27px;margin:0 0 6px;letter-spacing:-.4px;}
140
  .flag h3 .v{font-size:13px;color:var(--muted);font-weight:500;margin-left:8px;letter-spacing:0;}
141
  .flag .grid{display:grid;grid-template-columns:1.25fr 1fr;gap:30px;padding:14px 32px 30px;}
142
  .flag p{color:var(--soft);margin:0 0 16px;}
143
  .flag .stats{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:6px;}
144
  .stat{background:var(--bg);border:1px solid var(--line);border-radius:9px;padding:13px 15px;}
145
  .stat .n{font-size:21px;font-weight:680;color:var(--ink);}
146
  .stat .k{font-size:12px;color:var(--muted);margin-top:2px;}
147
  .spec{background:var(--bg);border:1px solid var(--line);border-radius:10px;padding:18px 18px;}
148
  .spec .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:10px;}
149
  .spec ul{margin:0;padding:0;list-style:none;font-size:13.5px;}
150
  .spec li{padding:6px 0;border-top:1px solid var(--line);color:var(--soft);display:flex;justify-content:space-between;gap:14px;}
151
  .spec li:first-child{border-top:none;}
152
  .spec li span{color:var(--muted);}
153
  .flag .foot{padding:0 32px 28px;display:flex;gap:18px;flex-wrap:wrap;font-size:14px;}
154
  @media(max-width:720px){.flag .grid{grid-template-columns:1fr;}}
155
156
  /* lab cards */
157
  .cards{display:grid;grid-template-columns:1fr 1fr;gap:20px;}
158
  @media(max-width:680px){.cards{grid-template-columns:1fr;}}
159
  .card{border:1px solid var(--line);border-radius:12px;overflow:hidden;background:var(--panel);
160
    display:flex;flex-direction:column;transition:border-color .15s,transform .15s;}
161
  .card:hover{border-color:var(--accent-dim);transform:translateY(-2px);}
162
  .card .thumb{height:172px;overflow:hidden;border-bottom:1px solid var(--line);background:#fff;}
163
  .card .thumb img{width:100%;height:100%;object-fit:cover;object-position:top left;display:block;}
164
  .card .body{padding:18px 20px 20px;display:flex;flex-direction:column;flex:1;}
165
  .card h3{margin:0 0 9px;font-size:17px;}
166
  .card p{margin:0 0 14px;font-size:14px;color:var(--soft);flex:1;}
167
  .tags{display:flex;flex-wrap:wrap;gap:6px;margin-bottom:14px;}
168
  .tags span{font-size:11.5px;color:var(--muted);background:var(--bg);border:1px solid var(--line);
169
    border-radius:5px;padding:3px 8px;}
170
  .card .lnk{font-size:13.5px;font-family:ui-monospace,Menlo,monospace;}
171
  .card .lnk::after{content:" →";}
172
173
  /* research */
174
  .rlede{color:var(--soft);max-width:680px;margin:-6px 0 26px;}
175
  .research{display:flex;flex-direction:column;gap:0;border:1px solid var(--line);border-radius:12px;overflow:hidden;}
176
  .ritem{display:grid;grid-template-columns:120px 1fr auto;gap:18px;align-items:center;
177
    padding:18px 22px;border-top:1px solid var(--line);}
178
  .ritem:first-child{border-top:none;}
179
  .ritem:hover{background:var(--panel);}
180
  .ritem .cls{font-size:11px;letter-spacing:.5px;text-transform:uppercase;color:var(--accent);}
181
  .ritem h3{margin:0 0 3px;font-size:16px;}
182
  .ritem p{margin:0;font-size:13.5px;color:var(--muted);}
183
  .ritem .go{font-family:ui-monospace,Menlo,monospace;font-size:13px;white-space:nowrap;}
184
  @media(max-width:680px){.ritem{grid-template-columns:1fr;gap:6px;}.ritem .go{margin-top:4px;}}
185
  .progs{margin-top:22px;}
186
  .progs .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:11px;}
187
  .progs .row{display:flex;flex-wrap:wrap;gap:7px;}
188
  .progs .row span{font-size:12.5px;color:var(--soft);background:var(--panel);border:1px solid var(--line);
189
    border-radius:6px;padding:4px 10px;}
190
191
  /* credentials */
192
  .cred{display:grid;grid-template-columns:1.1fr 1fr;gap:28px;}
193
  @media(max-width:680px){.cred{grid-template-columns:1fr;}}
194
  .cred p{color:var(--soft);margin:0 0 14px;}
195
  .cred .role{font-size:14px;color:var(--muted);}
196
  .cred .role b{color:var(--ink);font-weight:600;}
197
  .certs{list-style:none;margin:0;padding:0;}
198
  .certs li{padding:9px 0;border-top:1px solid var(--line);font-size:14px;color:var(--soft);
199
    display:flex;gap:10px;align-items:baseline;}
200
  .certs li:first-child{border-top:none;}
201
  .certs li .c{color:var(--accent);font-family:ui-monospace,Menlo,monospace;font-size:12px;}
202
203
  footer{padding:46px 0 64px;}
204
  footer .row{display:flex;flex-wrap:wrap;justify-content:space-between;gap:18px;align-items:center;}
205
  footer .links a{color:var(--soft);margin-right:20px;font-size:14px;}
206
  footer .note{color:var(--faint);font-size:12.5px;max-width:520px;}
207
208
  /* featured finding teaser */
209
  .featured{display:block;margin:30px 0 0;border:1px solid var(--line2);border-radius:14px;
210
    background:linear-gradient(180deg,#11181c 0%,var(--panel) 100%);overflow:hidden;
211
    transition:border-color .15s,transform .15s;}
212
  .featured:hover{border-color:var(--accent-dim);transform:translateY(-2px);}
213
  .ff-status{display:flex;align-items:center;gap:9px;font-size:12px;letter-spacing:1.2px;
214
    text-transform:uppercase;color:var(--accent);padding:12px 24px;border-bottom:1px solid var(--line);background:#0e1a18;}
215
  .ff-status .pulse{width:7px;height:7px;border-radius:50%;background:var(--accent);
216
    box-shadow:0 0 0 0 rgba(108,199,184,.5);animation:p 2.4s infinite;}
217
  .ff-main{display:flex;align-items:center;gap:22px;padding:22px 24px;}
218
  .ff-tag{font-size:11px;letter-spacing:1.5px;color:#ff8a8a;margin-bottom:9px;}
219
  .ff-main h3{margin:0 0 8px;font-size:21px;letter-spacing:-.3px;line-height:1.2;color:var(--ink);}
220
  .ff-main p{margin:0 0 12px;color:var(--soft);font-size:14.5px;max-width:690px;}
221
  .ff-main p b{color:var(--ink);font-weight:600;}
222
  .ff-facts{display:flex;flex-wrap:wrap;gap:6px 8px;}
223
  .ff-facts span{font-size:11.5px;color:var(--muted);background:var(--bg);border:1px solid var(--line);
224
    border-radius:5px;padding:3px 9px;}
225
  .ff-go{flex:none;color:var(--accent);font-size:14px;white-space:nowrap;}
226
  @media(max-width:680px){.ff-main{flex-direction:column;align-items:flex-start;gap:14px;}}
227
</style>
228
</head>
229
<body>
230
231
<nav><div class="wrap">
232
  <span class="brand mono">zion_boggan<span class="dot">.</span></span>
233
  <span class="links">
234
    <a href="#oversight">Oversight</a>
235
    <a href="#labs">Labs</a>
236
    <a href="#research">Research</a>
237
    <a href="#background">Background</a>
238
    <a href="https://github.com/zionboggan">GitHub</a>
239
  </span>
240
</div></nav>
241
242
<header class="hero"><div class="wrap">
243
  <div class="avail"><span class="pulse"></span>Open to detection engineering &amp; security roles · relocation OK</div>
244
  <h1>Zion Boggan</h1>
245
  <p class="sub">SOC analyst · independent security researcher · applied cryptography</p>
246
  <p class="lede">SOC analyst by trade, security researcher by hobby: I defend production
247
  networks, research vulnerabilities in the lab, and build systems that close the gaps I
248
  find. This is the work I can show: <b>detection
249
  pipelines and labs</b> that run end to end, <b>vulnerability research</b> across
250
  cryptographic and database internals, and <b>Oversight Protocol</b>, a post-quantum
251
  data-provenance system I maintain in Rust. Almost all of it runs on my own homelab.</p>
252
  <div class="cta">
253
    <a class="btn primary" href="#proof">▶ Watch a live break-in</a>
254
    <a class="btn" href="#oversight">See the work</a>
255
    <a class="btn" href="https://github.com/zionboggan">GitHub</a>
256
    <a class="btn" href="https://www.linkedin.com/in/zion-boggan">LinkedIn</a>
257
    <a class="btn" href="https://oversightprotocol.dev/">oversightprotocol.dev</a>
258
  </div>
259
  <div class="meta mono">
260
    <span>zionboggan0@gmail.com</span>
261
    <span>Security+ · SC-200 · AZ-104</span><span>Bugcrowd · HackerOne</span>
262
  </div>
263
</div></header>
264
265
<div class="wrap"><a class="featured" href="/featured-finding/">
266
  <div class="ff-status mono"><span class="pulse"></span>Coordinated disclosure in progress</div>
267
  <div class="ff-main">
268
    <div>
269
      <div class="ff-tag mono">★ FEATURED FINDING · LIVE VULNERABILITY RESEARCH</div>
270
      <h3>A certificate path-length limit that vanishes when you remove an unrelated field</h3>
271
      <p>A widely-deployed open-source crypto library enforces an RFC&nbsp;5280 CA path-length
272
        constraint <b>only when a separate extension is present</b>, so a CA forbidden from
273
        delegating can mint rogue sub-CAs the library still trusts. Found by variant-hunting a
274
        security patch the maintainers had just shipped. <b>Interactive proof you can run in the browser.</b></p>
275
      <div class="ff-facts mono">
276
        <span>CWE-295</span><span>RFC 5280 §6.1.4</span><span>CA constraint bypass</span>
277
        <span>Confirmed on the current shipped release</span>
278
      </div>
279
    </div>
280
    <span class="ff-go mono">Open the finding →</span>
281
  </div>
282
</a></div>
283
284
<section id="proof" class="proof"><div class="wrap">
285
  <div class="shead"><span class="idx mono">00</span><h2>See it in action</h2><span class="rule"></span></div>
286
  <p class="proof-intro">Three recordings, all real output, nothing staged: a web-app data
287
    breach and a full server takeover against targets I host in a lab I control, then a real
288
    cryptographic flaw I found and responsibly disclosed in production software. Offensive
289
    web, infrastructure, and deep code review, the range I actually work in. Never against
290
    systems I don't own.</p>
291
292
  <div class="demo">
293
    <div class="demobar">
294
      <span class="d r"></span><span class="d y"></span><span class="d g"></span>
295
      <span class="dlabel mono">01 · web-app breach · controlled lab</span>
296
      <span class="dbadge mono">REAL PoC</span>
297
    </div>
298
    <video class="demovid" autoplay muted loop playsinline preload="auto"
299
      poster="/assets/hero/exploit-demo-poster.jpg"
300
      onclick="if(this.requestFullscreen)this.requestFullscreen()">
301
      <source src="/assets/hero/exploit-demo.mp4" type="video/mp4">
302
    </video>
303
    <p class="democap"><span class="step mono">01 · DATA BREACH</span> A real SQL-injection chain
304
      against a web app (OWASP Juice Shop): <b>bypass the login with no password</b>, then
305
      <b>dump every account's stored credentials</b> straight from the database.</p>
306
  </div>
307
308
  <div class="demo">
309
    <div class="demobar">
310
      <span class="d r"></span><span class="d y"></span><span class="d g"></span>
311
      <span class="dlabel mono">02 · server takeover · controlled lab</span>
312
      <span class="dbadge mono">REAL PoC</span>
313
    </div>
314
    <video class="demovid" autoplay muted loop playsinline preload="auto"
315
      poster="/assets/hero/rce-demo-poster.jpg"
316
      onclick="if(this.requestFullscreen)this.requestFullscreen()">
317
      <source src="/assets/hero/rce-demo.mp4" type="video/mp4">
318
    </video>
319
    <p class="democap"><span class="step mono crit">02 · FULL TAKEOVER</span> Command injection in
320
      an appliance's diagnostics tool: a "ping" box that <b>runs whatever I type, as root</b>.
321
      One request turns into <b>remote code execution and the server's production secrets</b>.</p>
322
  </div>
323
324
  <div class="demo">
325
    <div class="demobar">
326
      <span class="d r"></span><span class="d y"></span><span class="d g"></span>
327
      <span class="dlabel mono">03 · cryptographic research · production code</span>
328
      <span class="dbadge alt mono">DISCLOSED</span>
329
    </div>
330
    <video class="demovid" autoplay muted loop playsinline preload="auto"
331
      poster="/assets/hero/crypto-demo-poster.jpg"
332
      onclick="if(this.requestFullscreen)this.requestFullscreen()">
333
      <source src="/assets/hero/crypto-demo.mp4" type="video/mp4">
334
    </video>
335
    <p class="democap"><span class="step mono">03 · CRYPTO RESEARCH</span> Not a lab, a real flaw I
336
      found and responsibly disclosed in <b>Fireblocks' MPC threshold-signature library</b>. A
337
      one-byte type confusion cut a 40-bit check down to 8 bits, so I <b>forge an invalid proof the
338
      production verifier accepts</b>, about 1 in 256 tries, with a control run that proves the cause.
339
      The difference between running tools and reading the crypto.</p>
340
  </div>
341
</div></section>
342
343
<section id="oversight"><div class="wrap">
344
  <div class="shead"><span class="idx mono">01</span><h2>Flagship</h2><span class="rule"></span></div>
345
  <div class="flag">
346
    <div class="top">
347
      <div class="tag mono">Open-source · Rust + Python</div>
348
      <h3>Oversight Protocol<span class="v mono">v0.4.11</span></h3>
349
    </div>
350
    <div class="grid">
351
      <div>
352
        <p>A cryptographic data-provenance system: a verifiable, tamper-evident record of
353
        where data came from and what happened to it, designed to hold up against a future
354
        with quantum computers. I'm the lead maintainer and primary contributor.</p>
355
        <p>The hard part is correctness across two languages, the Rust implementation and
356
        the Python reference are built to produce <b>bit-identical</b> output, enforced by a
357
        shared conformance suite. It pairs classical and post-quantum primitives so signatures
358
        and key exchange stay sound even if one side breaks.</p>
359
        <div class="stats">
360
          <div class="stat"><div class="n">12 crates</div><div class="k">~10.3k lines of Rust</div></div>
361
          <div class="stat"><div class="n">~13.4k lines</div><div class="k">Python reference impl</div></div>
362
          <div class="stat"><div class="n">141 tests</div><div class="k">125 Rust · 16 Python conformance</div></div>
363
          <div class="stat"><div class="n">FIPS 203/204</div><div class="k">ML-KEM-768 · ML-DSA-65</div></div>
364
        </div>
365
      </div>
366
      <div class="spec">
367
        <div class="sk mono">Cryptography</div>
368
        <ul>
369
          <li>Key exchange <span>X25519</span></li>
370
          <li>AEAD <span>XChaCha20-Poly1305</span></li>
371
          <li>Signatures <span>Ed25519</span></li>
372
          <li>KDF <span>HKDF-SHA256</span></li>
373
          <li>PQ KEM <span>ML-KEM-768</span></li>
374
          <li>PQ signatures <span>ML-DSA-65</span></li>
375
          <li>Transparency <span>Sigstore Rekor v2</span></li>
376
          <li>Timestamping <span>RFC 3161 TSA</span></li>
377
        </ul>
378
      </div>
379
    </div>
380
    <div class="foot">
381
      <a class="mono" href="https://oversightprotocol.dev/">oversightprotocol.dev →</a>
382
      <a class="mono" href="https://github.com/oversight-protocol/oversight">github.com/oversight-protocol/oversight →</a>
383
      <span class="mono" style="color:var(--faint)">Targeting USENIX Security &amp; Black Hat EU 2026</span>
384
    </div>
385
  </div>
386
</div></section>
387
388
<section id="labs"><div class="wrap">
389
  <div class="shead"><span class="idx mono">02</span><h2>Security Labs</h2><span class="rule"></span></div>
390
  <div class="cards">
391
392
    <a class="card" href="/detection-as-code/">
393
      <div class="thumb"><img loading="lazy" src="assets/detection.png" alt="One Sigma rule compiled to Splunk, Sentinel KQL and Elastic ES|QL"></div>
394
      <div class="body">
395
        <h3>Detection-as-Code</h3>
396
        <p>Sigma rules mapped to MITRE ATT&CK, linted and tested in CI, and compiled to
397
        Splunk, Elastic, and Microsoft Sentinel KQL, one rule, every SIEM. Detection
398
        engineering done as a pipeline, not a console click.</p>
399
        <div class="tags"><span>Sigma</span><span>Splunk</span><span>Sentinel KQL</span><span>Elastic</span></div>
400
        <span class="lnk mono">detection-as-code</span>
401
      </div>
402
    </a>
403
404
    <a class="card" href="/purple-team-lab/">
405
      <div class="thumb"><img loading="lazy" src="assets/purple.png" alt="Emulated ATT&CK techniques detected in Wazuh"></div>
406
      <div class="body">
407
        <h3>Purple-Team Lab</h3>
408
        <p>Adversary emulation that validates the detections. Atomic Red Team techniques run
409
        against an instrumented endpoint; custom Wazuh rules catch each one, with a coverage
410
        matrix proving the ATT&CK techniques fire at the right severity.</p>
411
        <div class="tags"><span>Atomic Red Team</span><span>Caldera</span><span>Wazuh FIM</span><span>MITRE ATT&CK</span></div>
412
        <span class="lnk mono">purple-team-lab</span>
413
      </div>
414
    </a>
415
416
    <a class="card" href="/soc-automation-lab/">
417
      <div class="thumb"><img loading="lazy" src="assets/soc.png" alt="Wazuh Threat Hunting dashboard with MITRE ATT&CK mapping"></div>
418
      <div class="body">
419
        <h3>SOC Automation Lab</h3>
420
        <p>Wazuh detection into Shuffle SOAR into TheHive case management. Endpoint telemetry,
421
        custom MITRE-mapped rules, automated enrichment and case creation. Deployed and shown
422
        live with an enrolled agent and a replayed SSH brute force.</p>
423
        <div class="tags"><span>Wazuh</span><span>TheHive</span><span>Shuffle</span><span>MITRE ATT&CK</span></div>
424
        <span class="lnk mono">soc-automation-lab</span>
425
      </div>
426
    </a>
427
428
    <a class="card" href="/secure-cicd-pipeline/">
429
      <div class="thumb"><img loading="lazy" src="assets/cicd.png" alt="Custom Semgrep rules failing the SAST gate"></div>
430
      <div class="body">
431
        <h3>Secure CI/CD Pipeline</h3>
432
        <p>A GitHub Actions pipeline that gates every merge on four checks, SAST, secret
433
        scanning, dependency audit, tests, with custom Semgrep rules and findings routed
434
        back to the SOC.</p>
435
        <div class="tags"><span>GitHub Actions</span><span>Semgrep</span><span>gitleaks</span><span>pip-audit</span></div>
436
        <span class="lnk mono">secure-cicd-pipeline</span>
437
      </div>
438
    </a>
439
440
    <a class="card" href="/cicd-supply-chain-security/">
441
      <div class="thumb"><img loading="lazy" src="assets/supply-chain.png" alt="Cosign signing and tamper detection"></div>
442
      <div class="body">
443
        <h3>CI/CD Supply-Chain Security</h3>
444
        <p>Proves the artifact, not just the source: keyless Cosign signing, a signed SBOM,
445
        grype scanning, and a Kyverno admission policy that refuses anything it can't verify.</p>
446
        <div class="tags"><span>Cosign</span><span>Sigstore</span><span>syft</span><span>Kyverno</span></div>
447
        <span class="lnk mono">cicd-supply-chain-security</span>
448
      </div>
449
    </a>
450
451
    <a class="card" href="/cti-detection-automation/">
452
      <div class="thumb"><img loading="lazy" src="assets/cti.png" alt="CTI rule-approval email with MITRE techniques"></div>
453
      <div class="body">
454
        <h3>CTI Detection Automation</h3>
455
        <p>Pulls indicators from live threat-intel feeds, dedupes across them, extracts the
456
        MITRE techniques, generates Wazuh rules, and emails an analyst for sign-off before
457
        anything goes live.</p>
458
        <div class="tags"><span>Python</span><span>ThreatFox / OTX</span><span>Wazuh CDB</span><span>ATT&CK</span></div>
459
        <span class="lnk mono">cti-detection-automation</span>
460
      </div>
461
    </a>
462
463
  </div>
464
</div></section>
465
466
<section id="research"><div class="wrap">
467
  <div class="shead"><span class="idx mono">03</span><h2>Vulnerability Research</h2><span class="rule"></span></div>
468
  <p class="rlede">Coordinated-disclosure research on Bugcrowd and HackerOne, focused on the
469
  places bugs are easy to miss and expensive to get wrong: cryptographic libraries, database
470
  engine internals, blockchain consensus, and authorization layers. Source-code analysis,
471
  protocol review, reproducible proof-of-concept.</p>
472
473
  <div class="research">
474
    <div class="ritem">
475
      <span class="cls mono">Notebook</span>
476
      <div><h3>Security research notebook</h3>
477
        <p>37 coordinated-disclosure writeups and methodology notes, 8 Fireblocks MPC findings
478
        (memory safety, signature verification, ZK-proof soundness), Postgres privilege-escalation
479
        chains, blockchain consensus, and camera firmware, each leading with how the bug was reached.</p></div>
480
      <a class="go" href="/security-research-notebook/">notebook →</a>
481
    </div>
482
    <div class="ritem">
483
      <span class="cls mono">JWT / auth</span>
484
      <div><h3>Schism, JWT differential fuzzer</h3>
485
        <p>Differentially tests JWT libraries against each other and the RFCs to surface
486
        algorithm-confusion and parsing-divergence bypasses.</p></div>
487
      <a class="go" href="/jwt-differential-fuzzer/">fuzzer →</a>
488
    </div>
489
    <div class="ritem">
490
      <span class="cls mono">Markets / quant</span>
491
      <div><h3>Prediction-market bot postmortem</h3>
492
        <p>A trading bot taken from edge hypothesis to a documented, honest negative result, the evaluation harness and why the edge didn't survive fees.</p></div>
493
      <a class="go" href="/prediction-market-bot-postmortem/">postmortem →</a>
494
    </div>
495
  </div>
496
497
  <div class="progs">
498
    <div class="sk mono">Programs researched</div>
499
    <div class="row">
500
      <span>Aiven (PostgreSQL · MySQL · ClickHouse · Valkey · Kafka)</span>
501
      <span>Fireblocks MPC</span><span>Electroneum</span><span>Cloudinary</span>
502
      <span>AXIS OS</span><span>Mattermost</span><span>GitLab</span><span>Databricks</span>
503
      <span>The Trade Desk</span><span>New Relic</span><span>Automattic / WordPress</span>
504
      <span>Snapchat</span><span>Vimeo</span><span>Airtable</span>
505
    </div>
506
  </div>
507
</div></section>
508
509
<section id="background"><div class="wrap">
510
  <div class="shead"><span class="idx mono">04</span><h2>Background</h2><span class="rule"></span></div>
511
  <div class="cred">
512
    <div>
513
      <p>Two years on a SOC desk at a managed security provider, triaging 150 to 300 alerts a
514
      shift across Splunk, Microsoft Sentinel, SentinelOne, and Stellar Cyber. I have supported
515
      incident response on ransomware cases (Cactus, BlackByte) and helped track vulnerability
516
      remediation against NIST 800-171 and CMMC baselines.</p>
517
      <p class="role"><b>SOC Analyst</b> · MSSP · 2024-present<br>
518
      <b>Prior:</b> Relationship Banker · Bank of America</p>
519
    </div>
520
    <ul class="certs">
521
      <li><span class="c">SEC+</span> CompTIA Security+ (SY0-701)</li>
522
      <li><span class="c">SC-200</span> Microsoft Security Operations Analyst</li>
523
      <li><span class="c">AZ-104</span> Microsoft Azure Administrator</li>
524
      <li><span class="c">AZ-900</span> Microsoft Azure Fundamentals</li>
525
      <li><span class="c">S1</span> SentinelOne Incident Responder</li>
526
      <li><span class="c">CySA+</span> CompTIA, scheduled June 2026</li>
527
    </ul>
528
  </div>
529
</div></section>
530
531
<footer><div class="wrap row">
532
  <div class="links">
533
    <a href="https://github.com/zionboggan">GitHub</a>
534
    <a href="https://www.linkedin.com/in/zion-boggan">LinkedIn</a>
535
    <a href="https://oversightprotocol.dev/">Oversight</a>
536
    <a href="mailto:zionboggan0@gmail.com">Email</a>
537
  </div>
538
  <div class="note">Built and deployed on a self-hosted Proxmox homelab. Source for every
539
  project is linked above.</div>
540
</div></footer>
541
542
</body>
543
</html>