Technology and security professional. I run business systems by day, and build security and intelligence tools through Covert Signals, my independent project.https://emerson.sh/en-ushttps://emerson.sh/writing/php2shell-first-24-hours/https://emerson.sh/writing/php2shell-first-24-hours/A critical flaw in PHP, two exposed services and no patch yet. What I closed first, why the order mattered, and the notice I sent.Wed, 28 Oct 2026 00:00:00 GMTSecurity & Privacyincident-responsephpvulnerability-managementreverse-proxyhttps://emerson.sh/writing/one-memory-for-two-coding-agents/https://emerson.sh/writing/one-memory-for-two-coding-agents/fact-store: one shared SQLite memory for Claude Code and Codex, with trust scores, budgeted hook injection and agents that save facts unprompted.Sat, 24 Oct 2026 00:00:00 GMTAI Agents & Engineeringagentsclaude-codecodexmcpsqlitememoryhttps://emerson.sh/writing/no-passwords-anywhere/https://emerson.sh/writing/no-passwords-anywhere/How I removed passwords from every sign-in path of my project's single sign-on, the trade-offs I accepted, and the rule I reversed a day later.Wed, 14 Oct 2026 00:00:00 GMTSecurity & Privacyidentitypasskeysauthentikmfassohttps://emerson.sh/writing/kayori-ui-refresh/https://emerson.sh/writing/kayori-ui-refresh/A year after I restarted Kayori in Rust, it has a quieter interface. A walk through an analyst's day, from the feed to a pinned finding.Sun, 11 Oct 2026 00:00:00 GMTBuilding Companieskayoriosintui-designaccessibilityhttps://emerson.sh/writing/ransomware-proof-backups-tested/https://emerson.sh/writing/ransomware-proof-backups-tested/Five questions about Kopia and Backblaze B2 Object Lock, how I tested each one, what happened, and the controls I put into production.Sun, 27 Sep 2026 00:00:00 GMTSecurity & Privacybackupsransomwarekopiabackblazeobject-lockhttps://emerson.sh/writing/plan-hand-off-verify/https://emerson.sh/writing/plan-hand-off-verify/The method I use to build Kayori with coding agents: written specs, narrow handoffs, CI-grade verification, and a human at the decision points.Sat, 16 May 2026 00:00:00 GMTAI Agents & Engineeringagentscoding-agentsspecstestingkayorihttps://emerson.sh/writing/structured-analytic-techniques/https://emerson.sh/writing/structured-analytic-techniques/The structured analytic techniques I actually use, grouped by family, with when to use each one, how to run it, and how it fails.Sat, 21 Mar 2026 00:00:00 GMTOSINT & Intelligencetradecraftanalysissatsosinthttps://emerson.sh/writing/building-kayori/https://emerson.sh/writing/building-kayori/Why I am building Kayori, a self-hosted OSINT workstation, what the first prototype taught me, and why I started again in Rust with a mesh in mind.Sat, 18 Oct 2025 00:00:00 GMTBuilding Companieskayoriosintrustlibp2parchitecturehttps://emerson.sh/writing/personal-data-classification/https://emerson.sh/writing/personal-data-classification/A simple template for individuals and small teams to label information by harm, and to mark how it must be stored and shared.Sat, 14 Jun 2025 00:00:00 GMTSecurity & Privacyclassificationopsecprivacydata-handlinghttps://emerson.sh/writing/anytone-at-d878uvii-plus/https://emerson.sh/writing/anytone-at-d878uvii-plus/Various programming notes for the AnyTone AT-D878UVII Plus radio.Sun, 04 May 2025 00:00:00 GMTRadiotwo-way-radiodmrhttps://emerson.sh/writing/ios-hardening-guide/https://emerson.sh/writing/ios-hardening-guide/A settings-by-settings checklist for an iPhone you depend on, and a one-line reason for every setting, so you can judge what fits your own risk.Sat, 19 Apr 2025 00:00:00 GMTSecurity & Privacyiosiphoneprivacyhardening