case study · security tooling
a cybersecurity tool that checks whether your paywalled fonts have leaked onto public github. it works like quiet reconnaissance: read-only, no clones, no stars, nothing that pings the repo. just a map of where your licensed type is exposed.
you pay for a font, or you draw one yourself, and then it leaks.
someone commits the .otf straight into a public repo, or
re-exports it to .woff2 for a landing page, and now a
paywalled typeface is sitting in assets/fonts/ with no
license and no credit.
finding it is the hard part, and the search itself is the risk. clone a repo to inspect it and you bump its traffic graph. star, fork, or open an issue and the owner gets pinged. most recon leaves fingerprints, so you end up announcing the investigation you wanted to run quietly.
point wallbreak at a folder of your own fonts. it fingerprints each one, searches github for matching files, pulls down each candidate, and grades how sure it is. the fingerprint is three things:
out comes a report: repo, stars, license, path, and the exact evidence that tripped each match. the same thing in json if you want to pipe it somewhere.
not every way of looking at a repo is equal. some reads are invisible, one bumps a counter, and a few notify the owner.
so wallbreak sticks to the three reads github shows nobody, and refuses everything else.
that rule isn't a line in a readme. it's a single network chokepoint
that refuses any request not on the allowlist, checked all the way down
to the url path, with a guard that parses the source tree so nothing can
smuggle a git clone out through a subprocess. of the 128
tests, a good chunk exist only to try to break that promise.
every hit shows the repo's license right next to it, because a copy isn't automatically a crime. maybe they actually bought it. the tool surfaces candidates with evidence and lets a human make the call. it never says "this is piracy."
full disclosure: i didn't hand-type all of it. wallbreak was built by a small crew of models running as a workflow. one directing, a panel of them designing the plan, two more grinding through 19 test-driven tasks, with every task passing a spec review and a code-quality review before it counted.
the real job was directing: setting the constraints (the no-trace rule up there), catching a couple of bugs the plan itself shipped with, and stepping in by hand when the api fell over mid-build. taste and judgment on top, horsepower underneath. that's the job now.