Security work

I write and run production software. Security work here means defending the systems I'm responsible for. It is not a separate product and I'm not a penetration testing firm.

What I work on

What the work is

• Reviewing code before it ships, mine and code I inherit on a repair job.
• Checking dependencies and server configuration, and patching what's out of date.
• TLS, and mail authentication (SPF, DKIM, DMARC).
• Access control and key handling. Keeping secrets out of repositories and out of logs.
• Reading logs when something looks wrong and working out what happened.
• Guard rails in payment and payout code so a bug can't move money it shouldn't.

The bench

I keep hardware for radio, RFID and embedded work. It gets used on my own devices and my own network.

• HackRF One with PortaPack H4M, RTL-SDR, YARD Stick One, with antennas covering 20 MHz to 6 GHz.
• Proxmark3 RDV4 with the LF and HF antenna sets.
• MT7921AU dual band WiFi adapter.
• Raspberry Pi 4 and 5 boards, a USB to UART converter, and Faraday bags and a Faraday box for isolating devices under test.
• Hardware security keys for my own accounts.

What I don't do

I don't test, probe or scan for vulnerabilities on any system without written permission from whoever owns it.

When I email a business about a broken website, what I found came from loading their public pages the way a browser does and looking at what came back. No login attempts, no guessing at hidden pages, no exploitation. If the fix involves anything deeper than that, it happens after they've hired me and said so in writing.

Reporting a problem

If you've found a security problem in something I run, email james@ironjackholdings.com. I'll reply the same day. The machine readable version of this is at /.well-known/security.txt.