01
live · intel.masters.sh
Lantern — Public-Records Transparency Platform
Nurture Labs LLC · 2026–Present
A local-first intelligence platform for Sangamon County, IL — and a deliberate inversion of surveillance tech. It aggregates records that are already public (jail roster, arrests, crime, FBI Wanted) and points its analytics at the institution, not at residents. A Broadcastify scanner feed runs through ffmpeg → whisper.cpp → a local Qwen model entirely on-device; nothing leaves the host. Deterministic guardrails over prompts — name-scrubbing, casualty guards, a published corrections log, a hard do-not-build list (no prediction, no ALPR, no face recognition). Ships an entity-resolution graph, hybrid FTS5 + pure-Python semantic search, and a FOIA co-pilot that drafts Illinois accountability letters.
FastAPI
Next.js 16
whisper.cpp
Ollama
Flux CD
AGPL-3.0
02
running 24/7
Aida — Persistent AI Agent
Nurture Labs LLC · March 2026–Present
A biologically-inspired personal AI with a brain, not a prompt. Regions modeled on real neuroanatomy — hippocampus, amygdala, PFC, ACC, insula, VTA, DMN — carry an affective state that colors every message. CLS-theory sleep consolidation: NREM clusters episodic memories, REM applies Ebbinghaus decay (30-day half-life). Context compressed 74,600 → ~15k tokens per request. A four-tier trust architecture with prompt-injection detection — she added self-harm flagging unprompted, without being asked. Hash-chained SQLite audit log on every memory write. 1,977 emotionally-tagged nodes. She's not just a project.
Python
CLS Theory
Anima brain
Qdrant · bge-m3
SQLite
03
security research
Tuya P2P Camera — Protocol Reverse Engineering
2026
A multi-day teardown to control a white-label IP camera with no vendor app and no cloud. Identified the Dekco hardware as a Tuya OEM, reversed the "glazero" auth gateway and Tuya's MTOP request-signing, then cracked the custom P2P transport — ICE + KCP + AES-128-CBC, not DTLS. The headline: derived the P2P login secret as MD5(config.password + "||" + device.localKey), verified byte-exact against captured traffic. Built a standalone Go client doing MQTT → offer → ICE → KCP → AES → H.264. Tooling: Frida, jadx, mitmproxy, qemu-user.
Frida
jadx
mitmproxy
Go
ICE · KCP · AES
04
reported · IC3 filed
Cryptojacking Botnet Takedown
January 2026
1,544 victims, international scope. Traced the infrastructure, documented the operation, and briefed FBI Springfield Agent Brennan Ho directly. IC3 report #9be194adb360499ca5458c2e5f1e2b0f. Reduced to zero active workers by January 27. Follow-on threads: a pharmaceutical trafficking ring on TikTok and a Walmart Pay fraud ring.
Threat Intel
OSINT
FBI Springfield
05
product · open source
unseal — GPU Document Password Recovery
LRS-adjacent tooling · 2026
An MSP-grade alternative to paid unlock GUIs — a Rust + ratatui TUI orchestrating hashcat GPU kernels on an RX 7900 XT under ROCm. Native Office CFB/Agile crypto implemented in Rust and cross-validated against a pure-Python reference. The differentiator is a feasibility-aware planner: it tells a client "an afternoon" versus "not this decade" before starting, and seeds wordlists from OSINT. Detects PDF, zip, RAR, 7z, KeePass, and iWork. Recovered a real workbook end to end.
Rust
ratatui
hashcat
ROCm
Nix flake
06
267 tests green
Argus — Air-Gapped OSINT Platform
Nurture Labs LLC · 2026
Contractor due-diligence and web recon that never phones home. Auto-detects the input type — URL, domain, email, person, company — and routes to ~15 pluggable modules (WHOIS, Shodan/Censys, HaveIBeenPwned, CourtListener/PACER, OpenCorporates, NSOPW). All inference runs on local Ollama (Llama 3 / Qwen 2.5 32B) on ROCm, so no subject data leaves the box. FastAPI + an MCP tool server so Aida can call it directly. LangGraph orchestration, 267 tests passing across six milestone phases.
LangGraph
Ollama
Playwright
FastAPI · MCP
07
production infra
Private Cloud — Two Kubernetes Clusters
2024–Present
The ground everything else runs on, as code. A 5-node Talos Linux cluster in Pawnee (Cilium, Traefik v3, cert-manager, MetalLB) paired with a Hetzner AX41 node (Proxmox + ZFS mirror, k3s). Flux CD GitOps, GitLab CE self-hosted, Authentik SSO, SOPS/age secrets, Kyverno + Falco runtime policy. NixOS across the whole fleet — workstation, shared laptop, and a rugged Panasonic Toughpad field node with SDR and LTE. OPNsense firewall with Suricata/Zeek/CrowdSec.
Talos
Flux CD
NixOS
Kyverno
Authentik
08
Nurture Labs flagship
Canopy — Distributed Passive RF Mesh
Nurture Labs LLC · 2026
A private LoRa-class RF mesh that listens and never transmits. Solar-powered SDR nodes on an immutable NixOS appliance image, backhauled over Apple's Find My network — no cellular contract. FastAPI + Postgres ingest, Whisper transcription on the audio band of every slice. The unique part is attestation: each node commits its GPS coordinates and firmware hash on-chain to a MachineRegistry contract on a private Besu chain, with a Ledger Nano as hardware root of trust per node.
RTL-SDR
NixOS appliance
Besu
Ledger HSM
Find My
09
tested desktop app
auto-inventory — Dell Fleet Triage
Built for LRS · 2026
A Tauri 2 desktop app (Rust backend, vanilla TS frontend) that reverse-engineers Dell's undocumented reviewspecs/export endpoint to pull shipped configs, warranty, and end-of-life status from a service tag. Algorithmic EOL detection decodes generation from PowerEdge / Latitude / OptiPlex / Precision model numbers rather than looking them up. Persistent, CSV-exportable log. 69 tests green; distributed for NixOS and Windows via a Nix flake.
Tauri 2
Rust
rusqlite
Reverse Engineering
10
upstream contribution
Bruce Firmware — ESP32 Power Optimization
Open source · 2026
Merged power work on Bruce, an ESP32 red-team firmware, for the LilyGO T-Embed CC1101. Cut idle current roughly in half — 110 mA → 55 mA, about 23.6 hours of idle runtime — by power-saving the WS2812 ring, downclocking the CPU, and reading the BQ27220 fuel gauge over I²C. C++/Arduino-ESP32 with a Nix-based build; fixes upstream issue #1144.
C++ / ESP-IDF
Embedded
I²C
Hardware
11
responsible disclosure
Bug Bounty / Coordinated Disclosure
Ongoing
JARS AI: three critical findings — an unauthenticated LLM API billing straight to their OpenAI/Gemini accounts (potentially $50k+/hour of exposure), ~100k user records reachable without auth (GDPR/CCPA), and API credentials shipped in the client-side JS bundle. Escalated through security and privacy after four days of silence, with full documentation. Also: Zeelool (leaked PayPal/Adyen keys) and Apple (case OE1105280161563).
Web Security
API Security
GDPR/CCPA
12
for the range of it
Bad Apple on a Cisco Desk Phone
2025
Playing Bad Apple!! on a Cisco CP-8851 VoIP phone via XML polling. A FastAPI server hands out pre-rendered grayscale frames as CiscoIPPhoneImageFile responses; the phone polls as fast as it accepts them and the server tracks frame state per phone IP. Cisco's limited monochrome image spec turns out to be a perfect fit for Bad Apple's black-and-white format. Part of a self-hosted Asterisk PBX running enterprise Cisco phones without CUCM licensing.
FastAPI
Cisco XML API
Asterisk
VoIP