Fifteen years securing other people's systems. Six months shipping my own.

github.com/Doogit/StackBadger

OPEN SOURCE · SECURITY TOOLING

StackBadger

A pentest harness for AI-assisted development, extracted from a production SaaS codebase, scrubbed, and generalized for any stack. Born inside TariffRefunded; now it outlives the sprint that created it.

VIEW REPO

Every project gets a verdict and a line on what carried forward. The kills count as much as the launches. Click any row for the full case study, or cross-read the security controls →

ReadySetBind2026 · INSURANCE OPS

Placement-to-bind automation for insurance agencies: quote PDF → AI extraction → human verify → e-sign → bind request. 813 commits, 243 PRs, 17 days. CARRIED FORWARDEvery third-party wrapper now returns an explicit status the caller must branch on; recurring defects get an automated gate, not a third paragraph of documentation; and access to every sensitive operation is explicitly denied by default and tested for every role.

LIVE · PILOT

SITE ↗

TariffRefunded2026 · CUSTOMS SAAS

IEEPA tariff refund recovery for SMB importers, racing a 180-day protest window. Broker partnership in progress. CARRIED FORWARDStackBadger was born here as the internal pentest harness. The PII-scrubbing patterns, the auth/data-isolation fix, and the decision-hygiene habit — a versioned strategy doc with an open-decisions table, plus dated site-vs-strategy audits — moved into everything after.

LIVE

SITE ↗

StackBadger2026 · SECURITY TOOL

Pentest harness for AI-assisted development — extracted from a production SaaS build, scrubbed, and open-sourced. The only code still earning commits after product work stopped. CARRIED FORWARDThe extract → scrub → review release playbook, now the standard path for anything leaving a private repo.

PUBLISHED

REPO ↗

SafeCircleOps2026 · OSINT / DFIR

Built in 5 days to help a friend being stalked: a local-only OSINT pipeline that discovers and tracks the stalker's online activity, to evidence standards — chain-of-custody manifests, fail-closed no-tip-off defaults, attribution scoring with negative controls. Report delivered to law enforcement. Deliberately unpublished. CARRIED FORWARDThe audit-the-design-before-building gate and the fail-closed posture. The repository itself stays private, permanently — it contains a real case.

PRIVATE

WRITE-UP

DealFinder2026 · REAL ESTATE INTEL

Pre-MLS lead intelligence for San Diego real-estate wholesaling: fragmented distress signals unified into explainable lead scoring. Full MVP in 7 days; paused unlaunched. CARRIED FORWARDCompliance shaping scope at design time — a fair-housing review removed an entire signal class before any code existed — and the checkpoint-and-circuit-breaker pattern for fragile, county-scale scrapers.

PAUSED

WRITE-UP

Interview prep system2026 · AGENT WORKSPACE

File-based interview prep as an agent workspace: citation-enforced knowledge base, ten evidence-based interviewer personas, and a mock-interview module that argues back in their voice. No database, no server — a directory layout and 12 skills. CARRIED FORWARDA general blueprint for becoming rapidly, defensibly conversant in any organization and its people — reusable for due diligence, sales prep, or expert-witness work.

PRIVATE

WRITE-UP

CyberReadyAI2026 · INSURANCE READINESS

Cyber insurance readiness platform for SMBs. Near-launch; paused with intent. 747 commits and the project that taught me to audit my own guardrails. CARRIED FORWARDThe guardrail rubric, the solution library, and the worktree protocol — and the successor product wrote its launch gates in advance precisely because this one validated late.

PAUSED

SITE ↗

PRD ONLY

PreCloseIntel2026 · M&A INTEL

Attack-surface intelligence for M&A due diligence: read a target's external security posture before the deal closes. Full PRD survived review; paused before build to focus on TariffRefunded. CARRIED FORWARDThe Idea → Build framework itself, which every later project's PRD ran through.

PAUSED

WRITE-UP

RiskScanAI2026 · FIRST BUILD

CIS IG1 risk assessment for small businesses — my first product, started off GitHub in late January; 160 commits across 15 active days. CARRIED FORWARDEverything — the successor is literally the same repository continued. Six agent skills and three reviewer agents survived into a roster that grew to 42 and 11, and the honest verdict (“nobody pays for an AI-interview risk assessment”) re-aimed the product at a question businesses do pay attention to.

SHELVED

POSTMORTEM

NO BUILD

PartMatch2026 · 3D PRINTING

3D-printable replacement parts from photos. Scrapped when the adversarial PRD review said "spike first." CARRIED FORWARDAdversarial review as a standing gate before any build.

SCRAPPED

KILL MEMO

Jan 27 – Jun 11, 2026. Bar length is calendar time; the labels are commits. Overlaps are real — some of these ran in parallel across ~35 agent worktrees.

The same 136 days as a sequence of decisions. Dates marked ~ are approximate.

Field notes from building with AI agents — specific incidents, real numbers, no generic advice.

Ideas that got a real PRD, real research, or real validation — and a deliberate no. Each one has a reason on record.