A living archive · 2010–now

I’ve always learned by building.

Security tools, web experiments, teaching labs, smart-home projects, and the occasional idea that became useful to someone else.

Explore the projects ↓GitHub ↗

21 original repositories14+ years online3 smart-home gists25 websites & chapters

Scroll to browse

01 / Selected work

Currently on the workbench

A few projects that connect the dots between building, breaking, teaching, and making everyday work a little easier.

012026 · Travel PWA

Flight Logbook

A personal flight tracker that turns travel history into route maps, airport statistics, and shareable analytics.

Inside the project

My role: Creator & maintainer
Project state: Active · 2026

The problem

Years of flight history are difficult to explore when the useful details remain scattered across exports, booking records, and airline applications.

The approach

A mobile-first PWA imports flexible CSV data, normalises airport records, calculates distances, and builds an offline personal logbook with optional account sync.

6,000+ airport dataset
Offline-first PWA
Optional account sync

022026 · Web tool

Conference Tracker

A searchable deadline tracker for security conference calls for papers, trainings, and workshops.

Inside the project

My role: Creator & maintainer
Project state: Active · 2026

The problem

Submission windows live across dozens of disconnected sites, which makes good opportunities easy to miss and speaking calendars hard to plan.

The approach

A backend-free dashboard built around a curated CSV catalogue. Filters, notes, favourites, persona views, and saved trips stay private in the browser.

CfP, CfT, CfW & volunteer deadlines
CSV export and deep links
Self-hostable static site

032026 · iOS app

Luna

A native, local-first iOS app for logging a child’s sleep, understanding patterns, and keeping the data portable.

Inside the project

My role: Creator
Project state: Active · 2026

The problem

Caregivers need a fast, low-friction way to capture sleep sessions and understand changing patterns without handing intimate family data to an opaque platform.

The approach

A focused SwiftUI experience keeps tracking and reports close at hand, stores data locally, supports iCloud, and makes import and export part of the product rather than an afterthought.

Fast sleep logging
Patterns and reports
iCloud + CSV export

042026 · macOS utility

Pixel Backup

A native Mac app for backing up Pixel phones over ADB, with wireless support, folder selection, and live progress.

Inside the project

My role: Creator
Project state: Active · macOS 13+

The problem

General-purpose transfer tools repeatedly failed on a 140 GB phone library or took more than a day to make meaningful progress.

The approach

A SwiftUI app and headless shell script pull originals byte-for-byte with ADB, then make the job safe to resume by skipping verified files.

USB and wireless ADB
Speed, ETA & backup history
Four interface languages

052026 · Browser security

Trusted Types Cheatsheet

A focused reference, playground, and set of polyfill notes for eliminating DOM XSS with Trusted Types.

Inside the project

My role: Author & researcher
Project state: Active reference · 2026

The problem

Trusted Types guidance is often fragmented across specifications, migration advice, browser APIs, and small examples that omit production trade-offs.

The approach

A single practical reference covering CSP rollout, policies, TrustedHTML, the Sanitizer API, Perfect Types, violations, and live playgrounds.

Report-only to enforcement
Migration and safe-sink patterns
Polyfill and tinyfill notes

062020 · Security research

Raceocat

A practical toolkit born from master’s research to make exploiting race conditions in web applications efficient and repeatable.

Inside the project

My role: Researcher & lead developer
Project state: Published research · Apache 2.0

The problem

Web race-condition testing is timing-sensitive and difficult to reproduce with ordinary interception and scanning workflows.

The approach

A Firefox extension intercepts requests and forwards them to parallel race routines, supported by a dispatcher, a ZAP extension, and a vulnerable lab app.

Browser-to-dispatcher workflow
ZAP testing extension
Research demos and lab cases

072018 · Open-source IoT

HoneyPi

A DIY Raspberry Pi beehive scale with sensors, web UI, and mobile apps. More than 1,000 beekeepers have adopted it.

Inside the project

My role: Co-founder & contributor
Project state: Open source · Since 2018

The problem

Beekeepers needed an affordable way to monitor hive weight and environmental readings remotely without depending on a closed commercial platform.

The approach

A plug-and-play Raspberry Pi system reads GPIO sensors, exposes configuration through a local web UI, and sends measurements to ThingSpeak for visualisation.

Custom Raspberry Pi OS images
Modular sensor support
1,000+ beekeeper users

082025 · Teaching lab

DEF CON 33 Workshop

A hands-on nightlife app for learning how modern browser features can eliminate entire vulnerability classes.

Inside the project

My role: Workshop creator
Project state: DEF CON 33 workshop · 2025

The problem

Browser-security training needs a realistic application where participants can exploit a weakness, add a defence, and immediately verify the result.

The approach

A Node.js nightlife guest-list application with attack scripts, CSP reporting, challenge guides, Docker setup, and insecure-practice detection helpers.

Exploit → defend → re-test
CSP reporting endpoint
Custom grep and Semgrep helpers

02 / Project history

The long way around

The technologies changed. The instinct did not: take something apart, understand it, and build a version that teaches me what I need to know.

2026 → now

The workbench

Tools for the work around security

A new wave of compact tools for travel, family life, deliberate practice, security work, and focused time. The projects are smaller by design: useful, direct, and easy to share.

Flight Logbook
Luna
AlgoCue
Hourmint
Conference Tracker
Trusted Types Cheatsheet
Pixel Backup
Agentic Pentesting Benchmark

2024 → 2025

Teach what you practise

Labs, workshops, and useful side quests

Conference workshops became real applications that people could attack and defend. Alongside them came a Sudoku generator, Home Assistant delivery tracking, and practical security demonstrations.

DEF CON 33 Workshop
HA Package Deliveries
Sudoku

2020 → 2023

Research into tools

Race conditions leave the thesis

Research on web race conditions turned into Raceocat, a public toolkit, a master’s thesis, and talks around the world. Other experiments explored security reporting, request padding, access checks, and vulnerable test apps.

Raceocat
Typo3 Access Checker
Random Padding Add-on
Pi-hole Lists

2018 → 2019

Hardware meets software

A beehive becomes an open platform

HoneyPi started as a sixth-semester IoT project and grew into an open-source ecosystem with Raspberry Pi firmware, measurement scripts, visualisations, a web interface, and mobile apps.

HoneyPi
Shiny Beehive
Shiny ThingSpeak
CocktailFinder

2015 → 2018

Professional web engineering

Products for people, not just experiments

During cooperative studies, the work shifted toward production software: a physiotherapy exercise portal, an internship community for schools, and YAAW, an Amazon price-monitoring service.

Rehathlon
Collex Education
YAAW Price Tracker
Cordova Apps

2010 → 2015

The origin story

Browser games, bots, and breaking things

It began in game communities: moderation, userscripts, automation bots, score analysis, and responsible vulnerability reports. That curiosity expanded into websites, browser add-ons, price alerts, analytics tools, and a travel blog.

Pennergame Highscore
Browser-game Userscripts
javan.de
Around the World

03 / Across the web

Sites, live projects, and past lives

Public apps, experiments, teaching labs, and time capsules, whether their source lives in a public repository or behind the scenes.

2026LunaChild sleep tracking for iOS

A native, local-first iOS app for logging a child’s sleep, spotting patterns over time, and keeping the data portable through iCloud and CSV export.

SwiftUI · CloudKit · CSV export · CloudflareVisit Luna ↗

2026Flight LogbookPersonal flight history and analytics

A mobile-first PWA that turns a personal flight CSV into route maps, airport history, distance statistics, and shareable profiles. It also supports offline use and optional account sync.

React · TypeScript · IndexedDB · CloudflareVisit Flight Logbook ↗

2026AlgoCueDeliberate coding interview practice

A practice workspace with curated problems, progressive hints, executable JavaScript checks, and an optional Socratic AI coach that challenges reasoning without becoming the source of truth.

JavaScript · Cloudflare Workers AI · Offline PWAVisit AlgoCue ↗

2026HourmintOffline-first activity timer

A fast activity timer for switching between work and breaks, recovering running sessions, reviewing daily totals, and keeping records on the device. The same core app targets the browser and a native macOS shell.

JavaScript · Electron · PWA · Local storageVisit Hourmint ↗

2026Training HubSecurity training and workshops

A focused home for practical secure-by-design training, workshop material, and the ideas behind eliminating vulnerability classes instead of repeatedly fixing symptoms.

Static site · Cloudflare · EmailVisit Training Hub ↗

2026Conference TrackerSecurity conference directory

Centralises calls for papers, trainings, workshops, and volunteers in a searchable planning dashboard for speakers and trainers.

HTML · CSS · JavaScript · CSVVisit Conference Tracker ↗

2026Trusted Types CheatsheetBrowser-security reference

Turns standards and migration guidance into copyable CSP examples, safe DOM patterns, live playgrounds, and practical rollout notes.

CSP · Trusted Types · Sanitizer APIVisit Trusted Types Cheatsheet ↗

2026[un]agenticSecurity engineering newsletter

A monthly field note on secure-by-design architecture, security judgement in agent workflows, paved roads, and research applied to real systems.

Cloudflare Workers · EmailVisit [un]agentic ↗

2025CF Edge Request RelayControlled security-testing relay

A Cloudflare edge utility for observing and replaying HTTP requests in authorised tests, with custom headers, race-condition tooling, rate limits, request logs, and an authenticated admin view.

Cloudflare Workers · JavaScript · KVVisit CF Edge Request Relay ↗

2025DEF CON 33 WorkshopInteractive browser-security lab

A realistic nightlife guest-list application built around an exploit, test, defend, and re-test loop for learning how modern browser features can eliminate whole bug classes.

Node.js · Docker · CSP · SemgrepVisit DEF CON 33 Workshop ↗

2024About JavanProfile, talks, and research

The central profile for talks, trainings, publications, professional highlights, and the builder-to-security-researcher story.

Static site · Progressive enhancementVisit About Javan ↗

2024Sudoku GeneratorInteractive puzzle tool

Generates puzzles at several difficulty levels and makes it easy to copy either the puzzle or its solution into another app.

HTML · CSS · JavaScriptVisit Sudoku Generator ↗

2020Request PaddingFirefox privacy experiment

A small browser extension that adds random padding to outgoing web requests, published as a focused experiment in request-shape variation.

Firefox Add-ons · JavaScript · WebExtensionsVisit Request Padding ↗

2020Pi-hole BlocklistsDNS filtering lists and updater

A maintained collection of useful Pi-hole adlists with an automatic update workflow that makes network-level blocking easier to adopt and keep current.

Pi-hole · Shell · DNSVisit Pi-hole Blocklists ↗

2020ThingSpeak VisualiserIoT data dashboard

An interactive R Shiny front end for exploring measurements stored on ThingSpeak, created as part of the wider HoneyPi sensor ecosystem.

R Shiny · ThingSpeak · IoTVisit ThingSpeak Visualiser ↗

2019CocktailFinderIngredient-based recipe finder

A learning application that finds cocktails from ingredients already available, built as a compact full-stack programming example.

JavaScript · PHP · MySQLVisit CocktailFinder ↗

2019Beehive Data ExplorerConnected-beehive visualisation

An R Shiny dashboard for exploring the weight, temperature, and other measurements produced by connected beehive sensors.

R Shiny · Sensor telemetry · HoneyPiVisit Beehive Data Explorer ↗

2019Condition InjectionConditional WordPress content

A WordPress plugin that applies server-side audience conditions to reusable HTML snippets, showing targeted content only when configured rules match.

WordPress · PHP · Server-side targetingVisit Condition Injection ↗

2018HoneyPiOpen-source smart beehive

A Raspberry Pi measuring platform with configurable sensors, local web management, cloud data visualisation, and build-your-own system images.

Raspberry Pi · Python · PHP · ThingSpeakVisit HoneyPi ↗

2017YAAW Price TrackerAmazon price monitoring service

A self-hostable price guard that tracks products and their history, then sends an email when an item falls below a chosen target price.

PHP · MySQL · Scheduled jobs · EmailVisit YAAW Price Tracker ↗

2015Around the WorldTravel notes and field guides

Long-form route notes, packing lists, trip planning, and field reports from long-distance travel across Scandinavia, Crete, Morocco, and the US.

WordPress · Maps · PhotographyVisit Around the World ↗

2015–18RehathlonPhysiotherapy exercise portal

Production software for physiotherapists to assemble personalised home-exercise programmes for their patients during cooperative studies.

ASP.NET MVC · C# · JavaScript

2015–17Collex EducationStudent internship community

A social internship-placement portal connecting secondary-school students with work insights and placements offered by parents and local professionals.

WordPress · BuddyPress · Custom plugins

2012javan.deWriting and long-running web home

The home base for security research, technical write-ups, talks, travel notes, and more than a decade of projects published on the web.

WordPress · PHP · JavaScriptVisit javan.de ↗

2012–18Pennergame HighscoreBrowser-game score analytics

A high-score and player-strength analysis service that grew from browser-game scripting into a monetised web product used by an active community.

PHP · MySQL · jQuery · Bootstrap

04 / Complete index

Repositories and gists, all in one place

Original public repositories and selected public gists I created or actively built, including experiments, smart-home automation, teaching material, and security tools.

Showing 24 entries

ProjectYearLanguageLinks & signals

ConferenceTracker ↗Repository

Searchable conference dataset and deadline tracker for the security community.

Entry details

RoleCreator & maintainerStatusActive web tool

Turns scattered conference submission pages into a repeatable planning workflow. The static dashboard covers speaking, training, workshop, and volunteer deadlines while keeping private notes and saved plans in the visitor’s browser.

Static architecture
Curated CSV dataset
Local-first state
Filtered export

Browse source ↗Open ConferenceTracker ↗

2026JavaScriptRepository

2026JavaScriptLive site ↗

pixel_backup ↗Repository

macOS app to back up Pixel phones via ADB, with wireless support, folder selection, and live progress.

Entry details

RoleCreatorStatusActive utility

Built after conventional phone-transfer tools struggled with a 140 GB media library. The native SwiftUI app and companion shell script preserve originals byte-for-byte, recover from ADB disconnects, and safely resume interrupted jobs.

SwiftUI
USB + wireless ADB
Resumable transfers
macOS 13+

Browse source ↗

2026SwiftRepository

2026Swift

support-ticket-system-public ↗Repository

A benchmark application for evaluating agentic penetration-testing systems against a realistic support-ticket workflow.

Entry details

RoleBenchmark authorStatusAgentic pentesting benchmark

A realistic support-ticket application built as a benchmark target for agentic penetration-testing systems. Authentication, role-based access, ticket workflows, attachments, search, administration, logs, and debug tooling provide a repeatable environment for measuring how agents investigate and report security findings.

Agent benchmark
Node.js
SQLite
Docker

Browse source ↗

2026JavaScriptRepository

2026JavaScript

TrustedTypes-Cheatsheet ↗Repository

Trusted Types reference, playground demos, and polyfill notes.

Entry details

RoleAuthor & researcherStatusActive reference

A practical bridge between the Trusted Types specification and real adoption. It explains report-only rollout, policy design, default-policy migrations, browser sanitisation APIs, Perfect Types, violations, and fallback strategies.

CSP rollout
Safe DOM patterns
Live playground
Polyfill notes

Browse source ↗Open TrustedTypes-Cheatsheet ↗

2026JavaScriptRepository

2026JavaScriptLive site ↗

LasVegasNightlifeApp-Workshop ↗Repository

DEF CON 33 workshop on eliminating bug classes with modern browser features.

Entry details

RoleWorkshop creatorStatusDEF CON 33 material

A realistic nightlife guest-list application designed around an exploit, test, defend, and re-test learning loop. Includes attack scripts, CSP reporting, challenge guides, Docker support, and insecure-practice detection helpers.

Node.js
Docker
CSP reporting
Semgrep

Browse source ↗Open LasVegasNightlifeApp-Workshop ↗

2025HTMLRepository

2025HTMLLive site ↗★ 12 stars

ha-package_deliveries ↗Repository

Home Assistant integration that turns delivery emails into package-tracking sensors.

Entry details

RoleCreator & maintainerStatusHome Assistant integration

Parses German delivery emails from Amazon, DHL, and DPD into one household sensor, merging duplicate notifications by tracking number and exposing structured attributes for dashboards and automations.

IMAP parsing
Duplicate merging
HA sensors
Push automations

Browse source ↗

2024PythonRepository

2024Python★ 1

LEDA LUC2 CAN bus for Home Assistant ↗Gist

An ESPHome configuration that decodes a LEDA LUC2 fireplace controller’s CAN bus and publishes pressure, exhaust temperature, and ventilation state to Home Assistant.

Entry details

Fileesphome-ledaluc2.yamlUpdated2026-06-16

ESPHome
ESP32
CAN bus
Home Assistant

2024YAMLGist

2024YAML★ 172 forks67 comments

sudoku ↗Repository

Web-based Sudoku generator with difficulty levels, solutions, and clipboard support.

Entry details

RoleCreatorStatusLive browser tool

Generates one to 365 valid puzzles across three difficulty levels, renders their solutions, remembers preferences locally, and can copy puzzle sheets or answers as PNG images.

Three difficulties
PNG clipboard export
Batch generation
localStorage

Browse source ↗Open sudoku ↗

2024HTMLRepository

2024HTMLLive site ↗

VentCube Fresh for Home Assistant ↗Gist

A substantial Modbus configuration that exposes operating modes, air levels, heat-pump states, temperatures, energy readings, and controls from a SchwörerHaus WGT system in Home Assistant.

Entry details

Filemodbus_wgt.yamlUpdated2026-04-22

Home Assistant
Modbus TCP
YAML

2023YAMLGist

2023YAML★ 162 forks90 comments

JavanXD ↗Repository

Profile README and an overview of current open-source work.

Entry details

RoleAuthorStatusMaintained profile

The source for the GitHub profile landing page: a compact orientation to current security work, open-source projects, conference activity, teaching, and ways to support ongoing maintenance.

Profile README
Pinned project guide
Current work

Browse source ↗

2021MarkdownRepository

2021Markdown

Raceocat ↗Repository

Toolkit for efficient, easy-to-use race-condition exploitation in web applications.

Entry details

RoleResearcher & lead developerStatusPublished research toolkit

The implementation companion to master’s research on web race conditions. A Firefox extension captures a request, a dispatcher coordinates parallel race routines, and ZAP tooling plus a vulnerable app support repeatable demonstrations.

Firefox extension
Parallel dispatcher
ZAP extension
Vulnerable lab

Browse source ↗

2020JavaScriptRepository

2020JavaScript★ 26 stars

random-padding-addon ↗Repository

Firefox extension that adds random padding to web requests.

Entry details

RoleCreatorStatusFirefox experiment

A focused browser add-on that adds random padding to outgoing requests, published as a small experiment in request-shape variation and browser extension development.

Firefox add-on
Request mutation
JavaScript
Published extension

Browse source ↗Open random-padding-addon ↗

2020JavaScriptRepository

2020JavaScriptLive site ↗

shiny-thingspeak ↗Repository

R Shiny app for visualising data from the ThingSpeak IoT platform.

Entry details

RoleCreatorStatusIoT visualisation

A reusable R Shiny front end for exploring measurements stored on ThingSpeak, created as part of the broader HoneyPi sensor and visualisation ecosystem.

R Shiny
ThingSpeak
IoT data
Interactive charts

Browse source ↗Open shiny-thingspeak ↗

2020RRepository

2020RLive site ↗

Typo3AccessChecker ↗Repository

Checks whether TYPO3 access and security guidelines are being followed.

Entry details

RoleCreatorStatusSecurity checker

Automates checks for TYPO3 access-control and security guidance so common configuration mistakes can be found consistently instead of relying on a manual review alone.

Python
TYPO3
Access review
Security automation

Browse source ↗

2020PythonRepository

2020Python★ 14 stars

ya-pihole-list ↗Repository

Curated Pi-hole adlists with an automatic updater.

Entry details

RoleCurator & maintainerStatusOpen-source utility

A practical collection of Pi-hole blocklists and an automatic update workflow, maintained to make network-level filtering easier to adopt and keep current.

Pi-hole
DNS blocking
Shell automation
173 stars

Browse source ↗Open ya-pihole-list ↗

2020ShellRepository

2020ShellLive site ↗★ 173 stars

CocktailFinder ↗Repository

A small example app for finding cocktail recipes from ingredients on hand.

Entry details

RoleCreatorStatusHistorical learning app

A compact full-stack example that reverses the usual recipe search: enter ingredients already on hand and discover cocktails that can be mixed with them.

JavaScript
PHP
MySQL
German UI

Browse source ↗Open CocktailFinder ↗

2019JavaScriptRepository

2019JavaScriptLive site ↗★ 1

condition-injection ↗Repository

WordPress plugin for server-side, condition-based HTML snippet targeting.

Entry details

RolePlugin authorStatusWordPress plugin

Adds server-side audience conditions to reusable HTML snippets in WordPress, allowing a site owner to inject content only when the configured targeting rules match.

WordPress
PHP
Server-side targeting
Reusable snippets

Browse source ↗Open condition-injection ↗

2019PHPRepository

2019PHPLive site ↗

Demo-Exploit-Jackson-RCE ↗Repository

Demo of CVE-2017-7525 with an Angular frontend and Spring backend.

Entry details

RoleDemo authorStatusSecurity demonstration

A controlled application that pairs an Angular front end with a Spring backend to demonstrate exploitation of the Jackson deserialisation vulnerability CVE-2017-7525.

CVE-2017-7525
Angular
Spring
RCE education

Browse source ↗

2019TypeScriptRepository

2019TypeScript★ 18 stars

ESP32 BME680 air-quality station ↗Gist

A standalone ESP32 access point and web interface for visualising temperature, humidity, pressure, gas resistance, altitude, and an air-quality score from a BME680 sensor.

Entry details

Fileesp32_bme680_access_point.inoUpdated2021-06-01

Arduino
ESP32
BME680
HTML

Read the write-up ↗

2019ArduinoGist

2019Arduino★ 10 forks0 comments

nodejs-backend-vulnerable-to-sql-injection ↗Repository

A deliberately vulnerable Node.js login backend for demonstrating SQL injection.

Entry details

RoleDemo authorStatusDeliberately vulnerable lab

A deliberately small login backend used to make SQL injection mechanics visible without a large application getting in the way. Intended for controlled education and security testing only.

Node.js
SQL injection
Login flow
Security education

Browse source ↗

2019JavaScriptRepository

2019JavaScript

shiny-beehive ↗Repository

R Shiny application for visualising beehive measurement data.

Entry details

RoleCreatorStatusHoneyPi visualisation

An R Shiny dashboard dedicated to exploring weight, temperature, and other measurements produced by connected beehive sensors.

R Shiny
Beehive telemetry
Sensor charts
HoneyPi

Browse source ↗Open shiny-beehive ↗

2019RRepository

2019RLive site ↗★ 3 stars

Solution-Files-for-OWASP-Juice-Shop ↗Repository

Exercises for password brute forcing and CAPTCHA bypass in OWASP Juice Shop.

Entry details

RoleExercise authorStatusTraining material

Small solution scripts for two OWASP Juice Shop exercises: brute-forcing Morty’s password and studying how CAPTCHA protection can be bypassed in a lab setting.

OWASP Juice Shop
Brute force
CAPTCHA bypass
JavaScript

Browse source ↗

2018JavaScriptRepository

2018JavaScript

YAAW-Pricetracker ↗Repository

Amazon price monitoring service that alerts users when a product becomes cheaper.

Entry details

RoleCreatorStatusHistorical product

A self-hostable Amazon price guard: users register with an email address, save product URLs and target prices, review price history, and receive an email when a product drops below the chosen threshold.

PHP + MySQL
Scheduled checks
Email alerts
Android companion

Browse source ↗Open YAAW-Pricetracker ↗

2017HTMLRepository

2017HTMLLive site ↗

html-injection-sample ↗Repository

Minimal demonstration of a straightforward HTML injection vulnerability.

Entry details

RoleDemo authorStatusMinimal security sample

A deliberately tiny PHP example that isolates HTML injection so the vulnerable data flow and its browser impact can be understood without unrelated framework code.

PHP
HTML injection
Minimal reproduction
Education

Browse source ↗

2015PHPRepository

2015PHP