Every system
has a flaw.
This is where
I go looking.
terminalflaw is one person's cybersecurity workshop, split across three live experiments: an agentic SOC that triages its own alerts, a graveyard for security topics that have run their course, and Nova — a chat that argues with several AI models at once so you don't have to trust just one.
Attached hosts
ls ~/terminalflaw/projectsThree subdomains, three different questions. One asks whether an AI agent can be trusted with a SOC queue, one asks what the field should stop pretending still works, and one asks what changes when the chatbot can consult more than one model.
soc.terminalflaw.xyz
Agentic SOC — proof of concept
A security operations centre where the first responder is an AI agent. Alerts land, the agent picks them up and writes back a triage — severity, likely cause, suggested next steps — so a human reviews judgement instead of raw noise. It's being built and stress-tested in the open, on synthetic alerts, before it is trusted with anything real.
epitaph.terminalflaw.xyz
A graveyard of security topics
Where dead security ideas get a proper burial. Retired protocols, deprecated tools, end-of-life software and the CVEs that taught the industry a lesson — each one laid to rest with an epitaph: what it was, how it died, and what replaced it. Part archive, part memorial, part warning to whatever is ageing badly right now.
nova.terminalflaw.xyz
Multi-provider cybersecurity chat
A chatbot built for security questions that refuses to be a single-model monoculture. Nova talks to multiple AI providers, so you can put the same detection rule, log snippet or threat question to different models and compare the answers side by side — because in security, a second opinion isn't a luxury.
House rules
cat ~/terminalflaw/PRINCIPLES.mdThe lab runs on a short set of rules. They exist because AI-assisted security work fails in predictable ways — and most of them are boring, which is exactly why they're written down.
Synthetic or it didn't happen
Experiments run on synthetic or redacted alerts. Real logs, real secrets and real client data never enter the test rig — a model that needs your crown jewels to demo itself has already failed the demo.
Verify the provider, not the post
Free tiers, token grants and "unlimited" offers get checked against the provider's own docs before anything is built on them. A screenshot of a deal is not a deal.
Cheap is a feature
The stack leans on free tiers, open models and small infrastructure on purpose. If the lab only works on an expensive plan, it isn't a lab — it's a subscription.
Bury what's dead, in writing
When a tool, protocol or workflow stops earning its place, it goes to Epitaph with a post-mortem. Undocumented deaths just get repeated by the next person.
Why “terminalflaw”? Because every post-mortem ends the same way: somewhere, in some terminal, a flaw was sitting in plain sight — a default left on, a patch skipped, a log nobody read. This site is a habit of looking before the incident report forces the issue.