Build a curl command that runs on the machine you paste it into
A curl generator that quotes for bash, PowerShell and cmd, writes the fetch() equivalent beside it, and warns about the flags that quietly change the request you meant to send.
Tag
reference
6posts
Redact a log before you share it: introducing the PII Sanitizer
Emails, cards, IPs, SSNs, API keys and secret-named values out of a log, trace or .env — checked rather than guessed, replaced in your browser, with a report of every hit.
Your Google Authenticator export QR code is not encrypted
The "Transfer accounts" QR is base64 protobuf — every 2FA seed in plain sight. Here is the format, the risk, and a browser-only decoder that reads it.
The real risk of online JWT decoders that log your secrets
A remote JWT decoder does not need to be malicious to leak your token. Here is what its log pipeline captures, what an attacker does with it, and how to test for it.
Verify, don't just trust: checking AI-generated cron jobs and infrastructure
An LLM will hand you a cron expression and a manifest that look right and run wrong. Here is the verification pass that catches them before a scheduler does.
The KitBoxDev privacy-first manifesto: local processing, zero egress
Data-egress policy made third-party utility sites a compliance problem. Our answer is architectural — every tool runs in your browser, so credentials never leave the machine.