Security engineering director by day, self-hoster by night. I build the tooling I wish existed for the infrastructure I actually run, and I hold it to the bar I'd expect at work: tests, signed releases, written decisions.
- compose-lint — security linter for Docker Compose files, grounded in OWASP and the CIS Docker Benchmark. SARIF output, GitHub Action, dry-run auto-fix. Every release is cosign-signed and traceable to the CI run that built it; security advisories are published with CVEs. Backed by a study of 11,000 public Compose files — 9 in 10 skip the basic security flags.
- container-sec-derive — runtime observation tool (Go, eBPF via Inspektor Gadget) that watches a container run and derives the minimum security config it actually needs — capabilities, read-only filesystem, devices — instead of guessing.
- container-security-profiles — evidence-backed least-privilege profiles for common self-hosted images, each with drop-test proof that the image still works.
- ig-advise-gadgets — Inspektor Gadget advisor gadgets that derive capabilities, read-only rootfs and device grants from live eBPF observation.
The thread through all four: least privilege should be measured, not guessed.
- Wrote the Compose-file scanner list (Rule 9) in the OWASP Docker Security Cheat Sheet.
- Writing: dev.to/tmatens · Docs: tmatens.github.io/compose-lint
Personal projects, personal views — not affiliated with my employer.