Mike Carroll. 20+ years in identity and security, now building with AI.
Find every app-specific password in a Google Workspace domain.
That's the credential that bypasses MFA. Flags admin accounts. Read-only by default.
Built in two days in August 2025, in response to the APT29 app-password campaign. Open-sourced June 2026.
GitHubFind the AI SDKs in a codebase and map them to compliance controls.
NIST AI RMF, ISO 42001 and the EU AI Act. Zero-dependency Python CLI, SARIF output, GitHub Action.
Apache-2.0.
Turns a scan into compliance documents for GRC teams, with a 30/60/90-day action plan. Secrets, emails and client identifiers are stripped before any model call.
See the sample reportI take contract work through SaaS Vista Inc.