Hey, I’m Danny 👋

Security engineer who writes the tools I need and open-sources them when they might help someone else. Mostly Go, C, and Python.

🛠️ Security as Code

I believe security operations should be versionable, diffable, and automated. These CLIs turn live SIEM and EDR platforms into code you can git diff:

• secops — operate Google SecOps (Chronicle SIEM + Siemplify SOAR) as code — pull detection rules, parsers, dashboards, and SOAR playbooks into files, review the diff, push back
• s1ctl — operate SentinelOne Singularity as code — agents, policies, exclusions, threat lifecycle, remote shell
• splunkctl — operate Splunk Enterprise SIEM as code — SPL search, detection-as-code YAML, alerts, dashboards, indexes

All three ship with machine-readable command trees and embedded agent guides — built for both humans and AI agents.

📜 Regulatory AI

Evidence-only RAG + MCP servers that hand your AI exact legal provisions — no hallucination, no paraphrasing. Every hit links to the official government source so you can verify the exact wording yourself:

• banhmi — Vietnamese banking & fintech regulation (State Bank of Vietnam, Ministry of Justice)
• laksa — Malaysian banking & fintech regulation (Bank Negara Malaysia, Securities Commission)

📦 Go SDKs

Small, focused clients for security and cloud platforms — each one go get-able straight off danny.vn/…:

🔬 Security Research

• offthebook — memory-only Windows PE execution via SMB-over-QUIC SEC_IMAGE loading, with position-independent shellcode in pure C (MSVC + Clang)

🔧 Other Tools

• byway — transparent per-app VPN bypass on Linux using cgroup v2 + nftables + policy routing
• flowcvcli — drive a FlowCV résumé from the command line or Python — content, design, templates, avatar, publish & PDF export

Everything’s on GitHub.