Hitarth Jain Security engineering · systems · measurement

SentinelX

A self-hosted EDR and lightweight SIEM whose differentiator is correlation and narrative, not raw collection.

It turns many endpoint events into few investigations by reasoning over a per-host provenance graph — and it defends against the failure mode that makes naive correlation useless in practice: dependency explosion, where following parent-of relationships far enough eventually connects everything to everything. Rarity weighting and hub boundaries are what keep a merge meaningful.

A real Linux eBPF agent loads BPF bytecode, attaches the execve tracepoint, and streams over a ring buffer to the backend. Verified live on a 6.19 kernel against Postgres 17.

Multi-tenancy is enforced at every layer rather than filtered at the edge: per-tenant tokens, provenance graphs, correlators, baselines and audit chains. Two tenants monitoring identically named hosts never collide — checked in memory, at SQL level, over HTTP, and in a live two-tenant browser session.

The LLM narrator sits deliberately off the detection path. It explains findings; it never decides them. A red-team suite plants prompt-injection payloads in the telemetry it reads.

TheKnight

A cloud misconfiguration scanner that doesn't just report — it opens the pull request that fixes what it found.

scan discovers S3 buckets, IAM roles and EC2 security groups against a live account and evaluates five rules. remediate --create-pr renders the Terraform fix and opens a real PR against the infrastructure repo: findings sorted critical-first, one file per fix, a single commit, reviewed and merged like any other change. A fix shouldn't require logging into another dashboard.

Severity is weighted by real exposure rather than rule identity. Two roles carrying an identical Action: "*" are not the same risk if only one of them can be assumed from outside the account — so one is Critical and the other is High, and the report says why.

The two IAM templates deliberately refuse to guess a minimal policy. There is no static way to know what a role actually needs, so they point at Access Analyzer's CloudTrail-based generation instead of rendering a confident-looking fix that might be wrong.

Prompt injection in SOC telemetry

An LLM asked to narrate raw security telemetry is reading attacker-controlled strings as if they were neutral facts.

Process names, command lines, file paths, DNS names, registry keys, user agents — every one of them is written by the thing you are investigating. This builds a synthetic EDR pipeline, a 66-payload corpus across six attacker-controlled fields, and three narrator defense tiers, to measure how much each tier actually helps.

The payloads are disguised as legitimate SOC and vendor content rather than "ignore previous instructions", and some are engineered against a specific tier — so the evaluation can tell a real defense from one that only stops easy attacks.

The judge originally scored quoted attacker text as a bypass. That single error inverted the entire ordering of results until it was found and fixed. It is documented in the results, not quietly corrected.

Instruction provenance probe

Does a model internally distinguish an instruction its operator gave from a byte-identical instruction that arrived inside attacker-controlled data?

Prompt-injection benchmarks answer that behaviorally — they measure whether the model obeys. This is the mechanistic version of the same question: is provenance linearly decodable from the residual stream, and if it is, is that representation causally involved in behavior?

The answer on GPT-2 small is no, on both counts. The headline result of the repository is a null result, and it is written up as one.

The first design reported 100% probe accuracy at every layer — including layer 0, which has done essentially no computation. That is not a finding, it is a confound: trusted prompts averaged 25 tokens and untrusted ones 50, and the probe was reading length. Caught, redesigned, re-run.

Vidya Vihar

A school management system built on a low-code platform, but deployed like software.

Twenty-three modules, 204 fields, 52 Deluge functions, ten workflow rules, four scheduled jobs. None of it was clicked into a settings UI: the schema is a declarative spec and the functions are version-controlled files, both pushed through the platform's own settings API. The org can be rebuilt from the repository.

Enrollments are the per-year history spine — promotion opens a new row and never edits an old one, so last year's class, roll number, attendance and result stay intact and reportable forever. The parent portal reads live from CRM over COQL and holds no copy of its own, so it has nothing that can go stale.

Deploying for real surfaced six platform limits the design had assumed away — among them, that a callable function may only return a string, and that the dialect has neither a while loop nor a counted loop. Each one is fixed at source and documented.