The Atelier Journal
Field notes on independent software and security — what I built, how it broke, and what held.
How Cat-AgentUI's System update page works when the code belongs to root and the service runs as its own user: the panel can only drop one short line into an inbox, and a root helper decides what that line is allowed to mean.
The public php2shell chain made me reopen PHP. What I actually practiced was not a flashy exploit, but a local lab habit: how to rank findings by evidence, how not to overclaim, and how to write something a maintainer can triage.
Cat-AgentUI's whole-turn timeout just went from 15 to 60 minutes. Here is why that is safe to do, and how the other limits on a single reply, from idle timeouts to tool rounds and concurrency, share the job of stopping a runaway turn.
Two recent changes to Cat-AgentUI's sandbox and Workspace: a bug where systemd-run silently ate `${...}` in sandboxed commands, and the checks I added when the file panel learned to move whole folders.
A walk through the threat model behind Cat-AgentUI, my self-hosted AI chat panel: who and what I trust, where the sandbox and workspace boundaries sit, and what I still want to test on my own instance.
A practical way to reduce scope without losing the reason your product should exist.
A release is more than a file transfer. Make it observable, repeatable, and possible to undo.
Use hierarchy, typography, and restraint to help the useful parts of an interface stand out.
The shelves
Half of the journal is about building small software; the other half is about keeping it safe. Every column has its own feed.
Indie development
Build notes from small products: scoping, architecture, shipping, and the parts that broke on the way there.
1 entryOpen →Security research
Vulnerability analysis, attack-surface walkthroughs, and write-ups from authorized testing and disclosed issues.
2 entriesOpen →Defensive engineering
Hardening, secure defaults, threat models, and the unglamorous controls that actually hold under pressure.
2 entriesOpen →CTF write-ups
Capture-the-flag challenges and exploit puzzles, solved step by step — dead ends and wrong turns included.
Awaiting its first entryOpen →Tools & infrastructure
Reusable recipes: deployment, scripts, configuration, and command-line know-how worth keeping close.
2 entriesOpen →Studio & interface
Letters from the workbench: releases, interface craft, and honest notes on working independently.
1 entryOpen →