WELCOME TO
BY PETER HANILY
WRITING - TALKS - TOOLS
MADE WITH EXPERIENCE, GRIT, LOVE AND TOKENS
If you work in security and have never heard of me, start with these six.
Story CTFRadar
With an hour left at WICC 2026, the public scoreboard froze. The lead changed hands twice in the last four minutes, seventy-one seconds apart. The Recapture replays both days second by second, rebuilt from 13GB of scoreboard state that arrived with no timestamps.
Read the event storyGuide
The sample case is a fictional OpenSlaw.ai breach, compromised smart appliances and a regrettable recipe included. Follow one note into its indicators, its timeline and a summary another analyst could use. No account, no AI provider.
Follow the guideBuild story
MacCrab watches system events on a Mac and shows them as readable alerts, including what AI coding tools did. It started as an experiment with Claude and Codex and became a local-first macOS app. It is still in public alpha.
Read it on maccrab.comResearch
Claude Code Artifacts cannot load off-site assets or contact other sites through fetch, XHR, WebSockets, EventSource or forms. I added an empty iframe and the browser gave it a fresh copy of WebRTC, which turns a shared Artifact into a canary token or bootstraps a chat. Anthropic closed the report as Informative.
Read the researchTalk SecOps Reset, Dublin
Thirty-one slides from the Irish Architectural Archive on why cheaper implementation changes which projects are worth attempting, and why that still doesn’t tell you who the tool is for. Attendees got a glow-in-the-dark pog each.
See the talkStory
In the summer of 2012 I had no Olympics and no job, and my father, who had worked in Dell, told me to learn to code. A rowing-club website, a search engine and a music player followed, and parts of them survive.
Read the storyTOOLS
The tools I’ve built.
SECURITY Web
Threat investigation workspace
Build an investigation from linked notes, IOCs, timelines and an entity graph. Core work stays in your browser; optional AI, team sync and cloud backups use services you configure.
SECURITY Web
Live tracker & replay for CTF competitions
CTFRadar tracks team-level activity on a competition range and replays it afterwards, with a link for any moment. It is meant for spectators and organisers, and it shows sampled observations, which are kept separate from the official results.
SECURITY macOS 13+ Public alpha
Real-time macOS threat detection
Investigate system activity and what AI coding tools did on your Mac. It runs an Endpoint Security system extension and needs Full Disk Access. Events stay in a local database; remote integrations are optional and off by default.
SECURITY macOS
Forensic plugins for MacCrab
Review a Mac's security posture with forensic plugins. First-party plugins use an unsandboxed Full Disk Access path. Check the offered release's privileges, signature and rebuild status before installing.
SECURITY Web Experimental
Prompt injection scanner
Inspect a prompt, see which rules matched, and compare it with the supplied examples. It is experimental. The scanner runs in your browser and the score still needs a person to judge whether the text is suspicious.
SECURITY Python CLI Experimental
Synthetic packet captures with an answer key
Generate the same synthetic capture every run, with the Zeek logs it produces and a labelled list of which flows were the attack. Everything in it is inert. Mechanical validity is checked separately from whether a capture supports the incident it claims to show.
Technology should be fun.
Max Clawdroom is a Max-Headroom-style desktop character for whichever AI assistant you use, with animated replies, outfits and optional voice controls. Pick an AI and Max becomes its new shell, chat window and all.
Public alpha · Rendering stays on your Mac and requests go through the assistant you configure. Editor awareness needs your permission; the install steps and privacy notes have the details.
A character preview. The Mac app connects to your configured assistant.
PRODUCTIVITY Web
Local-first HDR photo editor
ShinyPic brightens the highlights in a photo into real HDR values and processes the image in your browser. Try the supplied sample, compare the simulated preview and export HDR or SDR. What you see depends on your display and software.
THE 19TH HOLE Web
AI-powered open-source coleslaw
An AI startup parody with a real recipe and a browser arcade. The fictional APIs and pricing are part of the joke.
I’m Peter Hanily, a security engineer in Ireland. A decade of threat investigations, incident response, intelligence and detection work left me with a long list of tools I always wanted, and AI collapsed the implementation cost, so I built them. The ones that turned out to be useful and safe, I have published here.
Elsewhere: three features merged into Cisco Talos’s EvidenceForge , and two posts from my work at Oracle, on which security logs are worth collecting and shrinking the footprint of security log analysis .
