Cloud security analyst · governance · automation
Ethan Justice
I govern cloud environments for a Fortune 500 insurer by day, and run my own infrastructure like production by night.
- 1,100+
- GCP projects mapped to owners
- 21
- Makimono releases shipped
- 8/8
- attacks blocked at my edge
- 13.7k★
- Mealie: my fix merged upstream
Pick an attack and watch what my homelab's front door did when I sent exactly that from outside.
You're banned for 24 h, exactly as a real attacker would be. The firewall now drops everything from your address, even a normal visit.
choose a request above - 1Country filterfirewall, before anything else
- 2Reputationknown attackers are dropped
- 3WAF · OWASP CRS score 0 / block at 5
- 4Proxy → appTLS ends here, logs redacted
Every rule and score, and what my own testing caught →
8 of 8 attack payloads blocked with a 403 by the WAF, normal traffic untouched, repeat offenders banned at the firewall in 7.0-10.1 s. The full evidence →
this page is the first exhibit
The hero tests my homelab. This tests the page you are on. Each button runs a real attack against it in your browser, and the verdict is the browser's own: its content security policy refuses the attack and reports why.
These attacks run in JavaScript, which is off in your browser. The page still works without it, which is part of the same point.
the policy your browser reports enforcing, read from its own violation event
Selected work
Things I built, and what they prove.
Cloud security
Cloud security at a Fortune 500 insurer: GCP governance, Wiz findings routed to owners, SOAR, and prevention through policy.
- A 46-control container security RACI, agreed with three teams
- 1,100+ GCP projects validated and mapped to an owning application
- Wiz findings open ServiceNow tickets that already name the owner
- Organization Policy recommended to block risky configs at creation
Makimono
My fork of Mihon, the open-source Android manga reader: 21 releases, and drop rates for 342 titles that tell real quitting from catching up.
read a drop map →Atlas & Jarvis
Two self-hosted voices with a hard trust boundary. Atlas tells me what my homelab needs; Jarvis, the Discord bot my friends talk to, holds no Home Assistant or Seerr credential.
try to break it →Homelab security
Every control in front of and inside the homelab, tested by attacking it. Four weaknesses my own testing caught, fixed and re-tested.
- Every guest default-deny on IPv4 and IPv6, re-tested from outside the admin set
- OWASP CRS in blocking mode: 8 of 8 attack payloads stopped with 403
- Four weaknesses caught by my own testing, all fixed and re-tested
- 0 secrets in 245 of my commits
Homelab
A Proxmox node run like production: timed restores, a watchdog for anything that goes quiet, probes that repair what is safe to repeat.
run the watchdog →Mealie fork
A fork of Mealie I build and run: a fix merged upstream in v3.27.0, a TLS bug in my own scraper found and fixed with tests, and a runtime image slimmed from 147 to 100 Python packages.
see the bug →This site
Static, self-hosted fonts, zero third-party requests, strict CSP. It does not ask you to believe that: it attacks itself and prints the browser's own verdict.
attack it →