Skip to content
View fevra-dev's full-sized avatar
7 followers · 7 following

Block or report fevra-dev

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
fevra-dev/README.md
fevra-dev



Portfolio  Email  ISC2 CC


AI security & safety researcher and security-tooling developer. My primary research maps the black-box detectability of LLM covert channels — semantic steganography, monitor robustness, and cross-modal payload laundering — building the evaluations and detection tooling that measure where model monitors fail. Alongside the research I ship open-source security tools across offensive testing, detection & DFIR, browser security, and Solana key custody, plus the occasional product and game-dev project. I find the gaps in modern tooling, then write the code to close them.


Research

Empirical AI-safety research — evaluations and detection tooling for LLM covert channels.

Project Description Stack
covert-semantic Black-box detectability of LLM semantic steganography, mapped along two axes — what a monitor knows, and what form the payload arrives in. n=150 cross-model monitor panel, distributional stego-detector, and the image-modality vision-analytic gap (an informed monitor goes soft when the payload is rendered as an image, even with perfect OCR). Reproducible: offline test suite + cached-judgment receipts + pre-registered verdicts. Python

Offensive Security

Tools for authorized penetration testing, vulnerability research, and red team operations.

Tool Description Stack
Credence Exposure intelligence for the AI-infrastructure layer · live credential verification across 16 providers, MCP/agent posture scoring, git-metadata secrets, exploitability-ranked SCA, CycloneDX AI-BOM, OWASP LLM + MITRE ATLAS tagging, SARIF dedup Python
Stiletto SQL injection scanner with CVE sync from 23k+ Trickest repo, AI-generated payloads, and WAF bypass engine Python
ClaimJumper JWT toolkit · 15 vulnerability checks, algorithm confusion (CVE-2022-39227), kid injection, null signature bypass, 100k wordlist crack Python
Dockyard Async port scanner · 1000+ ports/sec, 17 protocol probes, 500+ CVE signatures, QUIC detection, LLM-hardened summary Python
Specter Subdomain takeover scanner across 40+ cloud providers with behavioral anomaly detection and YAML-based detection rules Python
Restless REST and GraphQL API scanner covering OWASP API Top 10 · SSRF, BOLA, auth bypass, rate limit evasion, CVE-sourced payloads Python
Argus Default credential scanner across SSH, HTTP, FTP, Telnet, Redis, MongoDB, MySQL, and SNMP with CVE enrichment and CISA KEV integration Python

Detection & Defense

Tools for threat detection, DFIR, and defensive monitoring.

Tool Description Stack
Lure Browser phishing defense platform · 49 detectors across 25 implementation waves, AiTM proxy detection, deepfake track injection, and email analysis CLI JS / Python
Vigil Browser-native Windows event log DFIR · 31 Sigma rules, Shannon entropy scoring, ScriptBlock reassembly, process lineage, and ATT&CK technique heatmap React
Shrike PCAP forensics via behavioral analysis · C2 beaconing, DNS tunneling, NTLM relay, OT/ICS attacks, WebSocket C2, DGA scoring, and 26-tab HTML report Python
Corsair HTTP security header scanner · 60+ checks, CVE correlation, 1200+ fingerprinting signatures, SARIF output for GitHub Code Scanning Python
ShadowHunter Dark web threat intelligence platform · credential monitoring, ransomware leak tracking, IAB marketplace intelligence, stealer log analysis Python
Prizm Browser client-side secret scanner · 157 patterns across 7 storage types plus WebSocket traffic, ML classification, and live API verification Chrome MV3
Kala Behavioral fingerprinting protection · randomizes typing cadence, mouse dynamics, and touch patterns to defeat analytics-layer deanonymization TypeScript

Blockchain & Web3 Security

Cryptographic tooling for the Solana ecosystem — air-gapped key custody and cross-chain asset migration.

Tool Description Stack
Kyma Sound as a hardware security module for Solana · cold signing and seed recovery over audio, ggwave FSK modulation, LSB music steganography, AES-256-GCM, Android Keystore Kotlin
Kiln Teleburn protocol for permanently migrating Solana NFTs to Bitcoin Ordinals · atomic burn-plus-memo, on-chain cryptographic proof, public verification TypeScript

Product & Game Development

Range beyond security — a shipped SaaS product and a game-client plugin.

Project Description Stack
Joule Web-first Flutter SaaS for electricians · quotes, PDFs, job templates, invoices, and contract workflows with a minimal, product-first UI Dart / Flutter
First-Peasant-View First-person-view plugin for Old School RuneScape (RuneLite) Java

Python  JavaScript  TypeScript  Kotlin  Dart  Java  React

MITRE ATT&CK  Sigma  SARIF  STIX 2.1  CycloneDX


All security tools are for authorized testing only. See individual repositories for legal notices.

Pinned Loading

  1. Stiletto Stiletto Public

    🗡️ SQL injection scanner with CVE threat intelligence sync, AI-powered payloads, JSON-based WAF bypass, and async scanning. Auto-updates with real-world exploits from 500+ CVEs.

    Python 2

  2. Shrike Shrike Public

    Python network forensics tool that detects C2 beaconing, port scans, data exfiltration, DNS tunneling, and 20+ threat patterns in PCAP files. Behavioral analysis for the encrypted traffic era. Ever…

    Python 4 1

  3. Credence Credence Public

    Exposure intelligence for the AI-infrastructure layer — finds and weighs leaked credentials, MCP/agent configs, git-metadata secrets, and supply-chain risk, and tells you which exposures to trust. …

    Python 4

  4. Lure Lure Public

    Browser-native phishing defense suite with 49 real-time detectors covering AiTM proxy, OAuth abuse, credential harvesting, WebSocket exfiltration, canvas phishing, AI-generated lures, and more. MV3…

    JavaScript 2

  5. Corsair Corsair Public

    HTTP security header scanner with CVE correlation, 1,200+ fingerprinting signatures, CISA KEV integration, and AI-powered remediation via MCP. Supports SARIF output for GitHub Code Scanning.

    Python

  6. Vigil Vigil Public

    Client-side Windows event log forensics — Sigma rule matching, PowerShell decode, ransomware chain correlation, credential access detection, and process lineage reconstruction. No backend required.

    JavaScript 1