We build privacy-first, zero-trust infrastructure engineered for extreme operational autonomy, regulatory compliance, and resilience.
GhostBill |
ChimeraScope |
X-Gateway OS |
ExpoScore |
GexAura |
|
-FF6600?style=flat-square){kind=icon}
Small, focused, permissively licensed tools maintained in the open. Each project is designed with explicit, conservative failure behavior and zero unnecessary dependencies.
| Tool / Repository | Language | License | Focus & Topics | Description |
|---|---|---|---|---|
| llm-security-gates |  |
 |
  |
Python security gates for LLM systems: prompt-injection filtering, model-artifact scanning, and garak-based red-team scoring. |
| patch-gate |  |
|
  |
Policy-gated preflight for applying untrusted unified diffs in CI and agent sandboxes: gate paths against escape/symlink/deny rules, git apply --check, then apply. Fails closed. |
| csaf-check | |
|
  |
Python API and CLI to validate CSAF 2.0 security advisories and VEX documents (@secvisogram/csaf-validator-lib), with CI-friendly unavailable-validator handling. |
| forgeguard | |
|
  |
Read-only security posture checks for authorized self-hosted Gitea and Forgejo: patch currency, CVE posture, container-registry and sign-in exposure. |
| ai-vault-contract |  |
|
  |
Starter Obsidian vault and write contract for AI-maintained knowledge bases (Claude + Codex): dedup, schemas, atomic notes. |
| Tool / Repository | Language | License | Focus & Topics | Description |
|---|---|---|---|---|
| cloudflare-origin-certs | |
|
  |
Bulk-issue Cloudflare Origin CA certificates and wire them into OpenLiteSpeed; scoped, backed-up edits, dry-run by default. (Shell tools; operations may require root - read project safety notes) |
| cloudflare-ufw-sync | |
|
  |
Additively synchronize a UFW allowlist with Cloudflare's published IP ranges, with input validation and dry-run support. |
| wp-hygiene-kit | |
|
  |
Read-only hygiene checks for hosts serving multiple WordPress sites: discover live installs, ClamAV scan, ownership checks. |
| deploy-guard-kit | |
|
  |
Read-only pre-deployment checks for single-host deploys: reserved-port conflicts, PM2 working-directory drift, and content-marker health checks. |
| site-canary | |
|
  |
Off-host synthetic monitor for multiple sites: status, content-marker, cross-tenant leak detection, and latency, with transition-based alerts to Telegram or a webhook. |
| Tool / Repository | Language | License | Focus & Topics | Description |
|---|---|---|---|---|
| contrast-matrix |  |
|
  |
WCAG color-contrast matrix checker for design tokens: evaluate tokens over solid, alpha, and derived backgrounds; deterministic worst-case, CI-first, JSON/SARIF. |
| indexnow-ping | |
|
  |
Submit sitemap URLs via IndexNow and optionally Google Search Console, with a robots.txt guard that refuses to announce pre-launch sites. |
© Gexiro Global Enterprises Ltd. Built with explicit, conservative security guarantees and sovereign engineering principles.