CirriusTech
  • Home
  • Tech
  • Projects
  • Shop
  • Personal
  • Fiction
  • About
  • Certifications
☕ Enjoying the content? Consider supporting me on Ko-fi

Projects & Research

Tools, Research & Open Source

Security research, open source tooling, and experimental projects. Built to explore, understand, and solve real problems.

🔬

cARL

Cognitive Agent Runtime Layer: a version-controlled governance layer for AI coding agents inside a repository.

GitHub
🔬

CopeLimit

A GitHub Copilot quota dashboard and iOS Scriptable widget, shipped as a Netlify PWA with serverless functions.

GitHub
🔬

SpecRecon (SpecQL + APISpy)

An API spec and API request reconnaissance suite for Azure REST surfaces, combining static analysis with live request visibility.

GitHub
🔬

CSPeek

A defensive CSP auditing tool that inspects response headers and reports deterministic configuration-hygiene findings.

GitHub
🔬

UndREST-SpecQL

An API spec query and analysis engine for Azure REST definitions, powering the UndREST APISpy ecosystem.

GitHub
🔬

UndREST-APISpy

A Chrome and Edge DevTools extension for real-time Azure and Microsoft API request inspection.

GitHub
  • ««
  • «
  • 1
  • 2
  • 3
  • 4
  • »
  • »»
Recent Posts
The Bigger the Judge, the Better the Judgment? Not Quite.
The Bigger the Judge, the …

A few days ago, I published High Confidence Is Not a Security Control, having spent some time looking at JEV, a specialised decision model, and the security implications of allowing probabilistic AI judgments to drive consequential actions. The concern was straightforward: a model receives evidence, …

October 8, 2026 Read
"High Confidence" Is Not a Security Control
"High Confidence" Is Not …

AI security tooling keeps getting faster. Faster triage, faster classification, faster threat intelligence analysis, faster decisions. And, increasingly, faster automated action. That’s exciting, but it’s also where things start getting dangerous. I’ve been looking at JEV recently, …

October 2, 2026 Read
'A Human Should Check It' is Not an Agentic Security Control
'A Human Should Check It' …

A little while ago I demonstrated something fairly simple. An attacker-controlled HTTP User-Agent value was ingested into Microsoft Sentinel as part of normal security telemetry. Security Copilot then consumed that telemetry while analysing the incident. The User-Agent contained an indirect prompt …

September 30, 2026 Read
Continuous Access Evaluation: Is it really tho?
Continuous Access …

This is a personal blog and all content herein is my own opinion and not that of my employer. Background Continuous Access Evaluation, or CAE, is one of those security controls with a wonderfully descriptive name. Access is not supposed to be evaluated only when you first authenticate. It is …

September 16, 2026 Read
Daddy Issues: When APIM Workspaces Inherit the Parent Identity
Daddy Issues: When APIM …

This is a personal blog and all content herein is my own opinion and not that of my employer. Introduction Sometimes security research starts with an exploit. Sometimes it starts with a much more boring question: “Where is the actual security boundary?” This one started with the latter. …

September 14, 2026 Read
What The Entra Fudge?! Tenant Restrictions v1 Doesn't Mean What You Think It Means
What The Entra Fudge?! …

If you implemented Tenant Restrictions v1 and only validated Restrict-Access-To-Tenants, you may only have implemented half the control you think you have.

August 19, 2026 Read
Footer logo
© 2026 All Rights Reserved