guest@geearr:~$ cat /etc/motd
> offensive & defensive security · by George Rios
Break it before they do. Penetration testing, application security, email security and cloud security by George Rios.
Hands-on penetration testing, application security, email security and cloud security — plus audits of AI-built apps and LLM agents — from an engineer with 25 years of shipping enterprise systems. I find it, prove it, and help you fix it.
tip: press : for a shell · 0–9 to jump tabs · t to cycle themes · j/k to scroll
george@geearr
- OS:
- offensive-security x86_64
- Host:
- geearr.com (edge)
- Uptime:
- 25 years
- Role:
- security engineer · fractional cto
- Focus:
- pentest · appsec · email · cloud · ai
- Packages:
- 5 security products shipped
- Sectors:
- fin · health · insurance · saas
- Location:
- united states · remote
- Contact:
- george@georgerios.com
guest@geearr:~$ uptime
geearr up 25 years, 5 security products shipped, led a 400K+ member platform as interim cto, load average: 0.00 slide decks
Security services
guest@geearr:~$ ls -la ~/services
total 5
- drwxr-x---george[PT]
penetration-testing/
Penetration Testing: manual web, API, perimeter & cloud pentests — every finding reproduced, fixed, retested - drwxr-x---george[AS]
application-security/
Application Security: secure code review, threat modeling, OAuth/OIDC review & CI/CD guardrails - drwxr-x---george[ES]
email-security/
Email Security: SPF · DKIM · DMARC to p=reject, MTA-STS, BIMI, BEC & phishing defense - drwxr-x---george[CS]
cloud-security/
Cloud Security: AWS · Azure · GCP · Cloudflare — IAM escalation paths, exposure & detection - drwxr-x---george[AI]
ai-app-security/
AI & Vibe-Coded App Security: audits for vibe-coded apps & LLM agents — secrets, RLS, prompt injection
# not sure where to start? take the free 5-minute AI-app self-check ↗ or read the guides.
What an engagement looks like
guest@geearr:~$ tail -f /var/log/geearr/engagement.log
A typical engagement moves from reconnaissance (subdomain discovery, exposed source code) through authorization testing (BOLA, mass assignment), email authentication review (DMARC, SPF), cloud IAM escalation and LLM prompt injection, to a report, merged fixes and retests confirming each finding is closed.
Approach: builder turned breaker
guest@geearr:~$ diff -u typical-report.txt geearr-report.txt
--- typical-report.txt +++ geearr-report.txt @@ finding 07 @@ - severity: HIGH (scanner default) - title: Insecure Direct Object Reference - fix: "Implement proper access controls." + severity: CRITICAL · CVSS 9.1 (cross-tenant data) + poc: enumerated 18,402 invoices as tenant-b in 4 min + cause: InvoiceRepository.find(id) ignores tenant_id + fix: PR #214 scope by tenant_id + regression test + retest: ✓ closed
# illustrative example
I have built OAuth servers, passwordless identity, tamper-evident audit logs and email-provenance systems — and led engineering for a regulated health platform serving 400K+ members. That is exactly why I know where systems like yours break.
- --read-the-code
- Not just the perimeter. Authorization logic, token handling, tenant isolation, data flows — where real breaches start.
- --prove-impact
- Findings are reproduced and chained into real attack paths, so you know which ten things matter out of a thousand.
- --fix-it
- As a working engineer and fractional CTO, I can write the patch, harden the pipeline and retest until it is closed.
Process
guest@geearr:~$ cat .geearr/pipeline.yml | geearr run
- ● stage 01
scope
Free 30-minute call: targets, rules of engagement, and what “done” looks like. Clear scope and quote up front.
- ● stage 02
recon
Map the real attack surface — code, endpoints, identities, cloud accounts, mail flows — including what nobody documented.
- ● stage 03
exploit
Hands-on testing that chains weaknesses into proven impact. Safe, controlled, coordinated with your team.
- ● stage 04
report
Findings with evidence, severity and fixes. Written for engineers, summarized for leadership and auditors.
- ● stage 05
retest
Patches written or reviewed with your team. Every fixed finding is retested and confirmed closed.
✓ pipeline passed · 5/5 stages · artifacts: report.pdf, attestation.pdf, fixes.patch
guest@geearr:~$ cat /etc/geearr/standards.conf
- OWASP Top 10
- OWASP ASVS
- OWASP API Top 10
- OWASP LLM Top 10
- PTES
- NIST CSF 2.0
- NIST SSDF
- MITRE ATT&CK
- MITRE ATLAS
- CIS Benchmarks
- SOC 2
- HIPAA
- PCI DSS 4.0
- GLBA
- RFC 7489 DMARC
- RFC 9700 OAuth BCP
# sectors: banks & credit unions · insurance · healthcare · fintech · saas · logistics
Security products I've shipped
guest@geearr:~$ ps aux | grep -i security
I don’t just test security — I build it. Identity, provenance, consent and audit-integrity products, designed and operated in production.
Fromenance
fromenance.com ↗email security · anti-phishing
Communication provenance for banks, credit unions, insurers and utilities.
Institutions register each outbound message at send time; customers ask “did you really send this?” and get Verified, Not verified or Known fraud. Failed checks become threat samples exportable as STIX 2.1 — closing the gap SPF, DKIM and DMARC leave open.
Engrave
tryengrave.com ↗audit integrity · ai agents
The black box recorder for AI agents.
Immutable audit evidence: RFC 6962 Merkle proofs against an Ed25519-signed tree head, witnessed hourly and RFC 3161-timestamped, verified client-side. Per-tenant keys and sequencers; an MCP layer records agent tool calls as a tamper-evident, hash-linked trace.
Identizen
identizen.com ↗identity · passwordless
Accountless identity.
Biometric sign-in approved on your phone, delivered to apps as standard OpenID Connect tokens. Per-site derived keys prevent cross-site tracking; single-use 60-second challenges with match codes block relay attacks; the index stores no secrets.
AuthnzNet
authnz.net ↗identity · dev tooling
OAuth 2.0 + OIDC server in three commands.
A free .NET tool that runs a standards-compliant OAuth 2.0 / OpenID Connect server: RS256 signing with auto-generated RSA-2048 keys published via JWKS, PKCE (S256), login UI and .well-known discovery.
PRYVC
pryvc.com ↗privacy · consent
OAuth for contact details.
A consent protocol: people approve which contact fields a business may use, for what purpose and how long — and revoke with one click. Envelope encryption with no staff decryption path, plus a hash-chained, append-only audit log with publicly verifiable consent certificates.
# more at portfolio.georgerios.com ↗
Field guides
guest@geearr:~$ ls -lt ~/guides
- 2026-10-124 min
How to get DMARC to p=reject without breaking email
A step-by-step DMARC enforcement rollout: inventory senders, fix SPF’s 10-lookup limit, align DKIM, move from p=none to quarantine to reject, and lock down parked domains. - 2026-10-123 min
Penetration test vs. vulnerability scan: what’s the difference?
How penetration tests and vulnerability scans differ, what scanners cannot find, which one PCI DSS 4.0, SOC 2 and HIPAA expect, and what a good pen test report contains. - 2026-10-123 min
Security checklist for AI-built (vibe-coded) apps
A practical pre-launch security checklist for apps built with Cursor, Claude, Lovable, Bolt or v0: secrets in bundles, Supabase RLS, server-side authorization, environments, backups and LLM agent risks. - 2026-10-123 min
OAuth 2.0 & OpenID Connect security review checklist
An OAuth 2.0 / OIDC security checklist based on RFC 9700: PKCE everywhere, exact redirect URI matching, strict JWT validation, token storage, refresh token rotation and sender-constrained tokens.
# terms you keep hearing, defined: glossary
FAQ
guest@geearr:~$ man geearr-faq
[+][-]Who is George Rios (geearr)?
George Rios — “geearr”, from his initials G.R. — is a US-based security engineer and fractional CTO with 25 years of experience building enterprise systems in financial services, healthcare, insurance, SaaS and logistics. Through geearr he offers penetration testing, application security, email security, cloud security and AI-application security audits, and he builds security products including Fromenance, Engrave, Identizen, AuthnzNet and PRYVC.
[+][-]What industries do you work with?
Mostly regulated and high-trust industries: banks and credit unions, insurance, healthcare, fintech, SaaS and logistics. Engagements are often driven by SOC 2, HIPAA, PCI DSS, GLBA or cyber-insurance requirements, and reports are written so they can be shared with auditors and underwriters.
[+][-]What do I get at the end of an engagement?
A written report with an executive summary, technical findings with evidence and severity, prioritized remediation guidance, a live readout with your team, and a retest of fixed issues. Where it helps, George also writes patches, configures CI/CD guardrails or applies DNS and cloud changes directly.
[+][-]How do I start a security engagement with geearr?
Book a free 30-minute scoping call at https://cal.com/georgerios/30min or email george@georgerios.com. You will get a clear scope and quote before any testing begins.
[+][-]What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated: it matches software versions and configurations against known issues and produces a long, noisy list. A penetration test is performed by a human who validates findings, chains weaknesses together, tests business logic, and demonstrates real impact. Scans are useful hygiene; a pen test tells you what an attacker could actually do.
[+][-]Do I need DMARC set to p=reject?
If you want to stop attackers from spoofing your exact domain, yes. A DMARC policy of p=none only monitors; it does not protect anyone. Google, Yahoo and Microsoft already require DMARC for bulk senders, and p=reject is the goal for any domain your customers trust. The safe path is a staged rollout that inventories every legitimate sender first.
[+][-]Is code generated by AI tools secure?
Not by default. AI coding assistants frequently produce working code with missing authorization checks, secrets embedded in front-end bundles, permissive database rules and outdated or non-existent dependencies. The code may function perfectly while exposing every customer record. An independent security review before launch is strongly recommended.
# every question, every service: /faq
Contact
guest@geearr:~$ finger george@geearr.com
- Login:
- george
- Name:
- George Rios
- Office:
- United States · remote
- Shell:
- /bin/zsh
- LinkedIn:
- linkedin.georgerios.com
- GitHub:
- github.com/noundry
Plan:
Find it before someone else does.
Tell me what you ship and what keeps you up at night. A free 30-minute scoping call gets you a clear plan and quote before any testing begins — whether or not we work together.
found a bug in this site? security.txt