↑ ↑ ↓ ↓ ↑ ↑ ↑ ↑ B A psst: try the Konami code.
Hi, I'm Basti. I'm learning to break software — and to build it. Padawan, not master: still in training, but the research is already real. My days go into the weeds of penetration testing and red teaming — infrastructure, web apps, and the strange new attack surface of AI & LLMs: all the places where things quietly go wrong. That research led somewhere: I'm now a member of the Omarchy Security Team.
On the other side of the keyboard I write Ruby and build with Ruby on Rails — deliberately, by hand. I made a conscious decision to master the language and the framework from the ground up before letting AI anywhere near my codebase. Knowing how something is built is the first step to knowing how it breaks.
# learning both: attacker mindset × builder's craft — that's the whole site.
Exec= line. Spec-level
escaping closes the latent sink.
Submitted upstream in basecamp/omarchy #8473 — under review.
> read the full writeup_
2026-08-25
Validating the cached Apple-display device path before use
Omarchy's brightness wrapper trusted any existing path from its device cache —
which could live at a predictable path in world-writable /tmp, up for grabs by
whoever writes it first. The hardening — merged upstream in basecamp/omarchy
#8198 — validates the cache's shape and drops the /tmp fallback.
> read the full writeup_
2026-08-24
Hardening Omarchy's plugin installer against git transport-helper URLs
omarchy-plugin-add cloned any user-supplied URL and silently relied on a git
default to keep ext::sh -c … from executing commands at clone time.
A small guard — merged upstream in basecamp/omarchy #8067 — closes the gap.
> read the full writeup_
Training an attacker's eye across the stack — penetration testing and red teaming, from web apps to AI & LLMs: broken auth, injections, logic flaws, prompt attacks. Still learning, already finding — responsible disclosure, always.
Building web applications the Rails way — convention over configuration, majestic monoliths, boring tech that ships. Learning it by hand, line by line, no autopilot.
The whole journey is public: what I learn, what I break, what I build. Notes, videos and the occasional detour — shipped as it happens, warts included.
Found a bug in my site? Even better — tell me how you found it.
# Omarchy security matters go to basti@omarchy.org — please use only that address for anything Omarchy.