// chris johnsonI'm a security engineer and build with AI agents on my own time. This is where I write it all down: the security reviews, the home-lab SOC, the agent workflows, and the bugs that got past all of them.
Chris Johnson
Security Engineer · Builder
Notes, experiments, and postmortems. Writing is a thinking tool here, not a marketing funnel.
Eight months of one-session-at-a-time skills, hooks and agents had never been checked. Part 1 of the Claude Harness Modernization series: the plan, and the audit tool that found a hook that could run for 83 minutes and a Windows guard that never blocked anything.
Most posts belong to a running series. Pick one and read it in order, from part one.
What I built this year, from a home SOC to the AI setup behind all of it. More on the portfolio page.
Wazuh on four hosts, a ClickHouse log lake fed by the UDM Pro and Pi-hole, and a Mission Control dashboard that turns DNS traffic into threat-intel detections. Planned, deployed, and debugged in public across three series.
Two rounds so far. In round two, five security agents and an advocate for my priorities had to agree before anything shipped. They caught a blog draft that could have run code on the server. It's fixed, deployed, and checked in CI on every push.
A local-first personal finance app. Bank exports land in one SQLite file on my machine, and the chat answers questions by querying that database through MCP tools, using the Claude CLI I already had.
An MIT-licensed study app for open-book GIAC exams: a page-accurate book reader, full-text search that cites book and page, quiz decks, and grounded Q&A over your own course PDFs.
A lazy-loading MCP server for UniFi Network, Protect, and Access, packaged as a Claude Code plugin. Built in three days, then maintained in the open with issues, releases, and semver.
The open-source harness behind everything above: memory that survives sessions, specialist agents, hooks, and multi-agent workflows for writing, reviewing, and shipping.
Two retro rebuilds, live in the browser. No installs, no accounts. Just hit Play.
Everything I know about securing software has an expiration date.
My day job is cybersecurity defense operations: detection, response, and resilience. The road here was unusual, and every stop left a fingerprint on how I build:
This blog is where I build in public. Most posts are postmortems of projects I'm still wrestling with, from security reviews of my own code to a home-lab SOC and the agent workflows behind all of it. They're written from inside the build, not from the tidy other side.
I also take on a small number of security and infrastructure engagements through CryptoFlex LLC. See services More about me
One email each Monday with what I published that week. No tracking pixels, no growth hacks, and an unsubscribe link in every issue.