Skip to content
View tmatens's full-sized avatar
4 followers · 6 following

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx4Achievement: StarstruckAchievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pair Extraordinairex2Achievement: Pull Sharkx4Achievement: StarstruckAchievement: YOLOAchievement: Quickdraw

Highlights

  • Pro

Block or report tmatens

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
tmatens/README.md

Todd Matens

Security engineering director by day, self-hoster by night. I build the tooling I wish existed for the infrastructure I actually run, and I hold it to the bar I'd expect at work: tests, signed releases, written decisions.

What I'm building

  • compose-lint is a security linter for Docker Compose files, grounded in OWASP and the CIS Docker Benchmark. It has SARIF output, a GitHub Action and a dry-run auto-fix. Every release is cosign-signed and traceable to the CI run that built it, and security advisories are published on GitHub. It is backed by a study of 11,000 public Compose files: 9 in 10 skip the basic security flags.
  • advisory-review-lag measures how long a security fix takes to reach the GitHub Advisory Database, which is where Dependabot alerts come from. Across 14,173 advisories, the median wait was 1 to 5 days for fixes released through March 2026 and 37 to 42 days for fixes released in June and July 2026. The write-up is The fix ships weeks before your scanner knows.
  • lyngvi is a hardened container for a coding agent that holds real, scoped credentials. The agent can push branches and open pull requests. It cannot merge to a protected branch, reach the host or leave its egress allowlist, and each of those limits is enforced by something outside the agent's reach.
  • container-sec-derive is a runtime observation tool (Go, eBPF via Inspektor Gadget). It watches a container run and derives the minimum security config the container needs: capabilities, read-only filesystem and devices.
  • container-security-profiles is a set of least-privilege profiles for common self-hosted images. Each one comes with drop-test proof that the image still works.
  • ig-advise-gadgets is a set of Inspektor Gadget advisor gadgets that derive capabilities, read-only rootfs and device grants from live eBPF observation.

Elsewhere

These are personal projects and personal views. They are not affiliated with my employer.

Pinned Loading

  1. compose-lint compose-lint Public

    Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

    Python 64 5

  2. advisory-review-lag advisory-review-lag Public

    Measures the time from a security fix release to its review into the GitHub Advisory Database

    Python

  3. lyngvi lyngvi Public

    A hardened container for a coding agent that cannot deploy

    Shell

  4. container-sec-derive container-sec-derive Public

    Runtime observation tool that derives the minimum container security config an image actually needs by watching it run.

    Go 1

  5. container-security-profiles container-security-profiles Public

    Evidence-backed minimum-security profiles for container images: the capabilities and read-only-filesystem config each image actually needs, with drop-test proof

    Shell 1

  6. asuswrt-merlin-aimesh-vlan asuswrt-merlin-aimesh-vlan Public

    VLAN-tag AiMesh Guest/IoT SSIDs on Asuswrt-Merlin without losing them on restart_wireless or AiMesh resync

    Shell 2