Skip to content
View PhinehasNarh's full-sized avatar
👾
Attack to defend
👾
Attack to defend
6 followers · 11 following

Achievements

Achievement: Pull Sharkx2Achievement: Pair ExtraordinaireAchievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pull Sharkx2Achievement: Pair ExtraordinaireAchievement: YOLOAchievement: Quickdraw

Block or report PhinehasNarh

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
PhinehasNarh/README.md

Phinehas Narh

Security Engineer. I break web apps, APIs, and cloud, then build the tooling and controls so it does not happen twice. Application Security by day; I ship security tools and send fixes upstream on the side.

LinkedIn  ·  X  ·  Portfolio  ·  CV  ·  phinehastettehnarh@gmail.com

Open source

Security fixes and detectors sent upstream to projects I use.

Project Contribution Status
NVIDIA / garak Unicode normalisation for the StringDetector, on NVIDIA's LLM vulnerability scanner Merged
mlrun Fixed a tar-slip path traversal in clone_tgz() archive extraction Merged
canonical / cloud-init Type annotations for distros.parsers.hosts Merged
checkov New policy CKV_AWS_394 for public Secrets Manager secrets In review
gitleaks Detection rules for Groq and xAI API keys In review
trufflehog Cerebras API key detector In review

Toolkit

Area Stack
Languages Python, C#, Go, Bash
Offensive Burp Suite, Metasploit, Nmap, Nessus, Nuclei, Wireshark, Kali Linux
AppSec & DevSecOps SonarQube, Trivy, Checkov, Gitleaks, OWASP Top 10, Docker, Kubernetes, GitHub Actions, nginx
Cloud AWS, Azure, Google Cloud, Microsoft Defender, Zscaler
Detection & DFIR MITRE ATT&CK, threat hunting, threat intelligence, incident response, digital forensics
Governance ISO 27001/27701, PCI-DSS, NIST 800-53, CIS Benchmarks

A shell script is a bash script, but a bash script is not necessarily a shell script.

Pinned Loading

  1. cve-research cve-research Public

    Security research: CVE documentation with technical breakdowns, detection scripts, and educational PoC code

    Python

  2. vuln-console vuln-console Public

    Codebase Vulnerability Triage and Remediation Console: self hosted single pane of glass for application security findings

    Python

  3. pygen pygen Public

    pygen is a package vulnerability triage and remediation for debian family systems

    Python

  4. CTI-Cyber-Threat-Intelligence-Toolkit CTI-Cyber-Threat-Intelligence-Toolkit Public

    CTI – Cyber Threat Intelligence Toolkit Python backend for ingesting, processing, and visualizing threat intelligence feeds. Handles IOCs, KEV tracking, RSS feeds, and enrichment services. Designed…

    JavaScript

  5. git-collect git-collect Public

    gitcollect is a small, dependency-free Git repository hygiene scanner

    Python

  6. write-blocker write-blocker Public

    OS-level software write blocker for digital forensics

    C