Information security engineer on a CIRT, and the person behind Penumbra Forge LLC — a one-person software studio maintaining developer and security utilities with explicit network boundaries.
Most of this work is early. Reproducible bug reports are welcome.
Gate — experimental — A local CLI that looks for secret-like patterns in source files and git history. It can install a repository-local pre-commit hook and attempt bounded rewrites for supported source forms. Optional provider verification sends matched credentials to the selected provider. Expect false positives and misses.
vexes — experimental — A local CLI that matches dependency coordinates to OSV across ten ecosystems and, for npm/PyPI, surfaces bounded source and registry heuristics. Findings may be incomplete and are not safety verdicts. Zero external runtime npm dependencies; scans still contact documented upstream services.
mcp-librarian — experimental — An MCP server that gives coding agents a local skill library. BM25 search, Ed25519 signing on supported writes, and integrity status recorded during indexing. Current load responses do not enforce refusal of tampered content, so clients must check status. No external runtime dependencies.
penumbraforge.com — A catalog of mostly small developer and security utilities with browser, edge, direct-network, and selectable-AI routes labelled on each page. There's also a machine-readable index and an MCP server for non-model utility functions. No accounts; check a utility's disclosure before entering sensitive data.
Umbra — A private, unreleased local AI application being developed on Apple Silicon with MLX. A working prototype exists, but there is no public build or supported release yet.
- Site: penumbraforge.com
- LinkedIn: shadoe-myers
- Location: Arizona