Lab

Secure Code MetaDynamics · Lab

Things we build to find something out.

This is the workbench of Secure Code MetaDynamics. Games, self-hosted servers, a code editor, a platform for regulated products: each one starts with a question, and whatever comes out is listed here, finished or not.

EXP 03 · Out of the lab · for clients only

The cybersecurity file of a regulated product, kept current from live data instead of rewritten for every audit.

Our biggest experiment grew into a product. CyberSuite manages the cybersecurity documentation and evidence of medical devices and other regulated products: from the SBOM of each part to the submission package for the FDA, the MDR or the Cyber Resilience Act.

What it does Request access

  1. 01SBOM
  2. 02Vulnerabilities
  3. 03Risks
  4. 04Documents
  5. 05Submission

Experiments

Numbered in the order we started them. Mixed on purpose: a game sits next to a file server.

Show

cobiserver

Works

A sync server for KOReader that you run yourself.

Question
Can you replace the official KOReader sync server without changing anything in the app?
Result
Yes. It speaks the same protocol, and adds what that protocol leaves out: a web page to register, change your password or get it back.

Self-hosted server

Go · SQLite · Docker

nander

Works

A file manager for your own server, used from the browser.

Question
Can a self-hosted file manager feel like Finder in the browser, dragging files out to the desktop included?
Result
Mostly. Drag in and out, previews, share links, a sandbox per user. Dragging out to the desktop only works in Chromium browsers. That is a browser limit, and the docs say so.

Self-hosted server

Go · SQLite · Docker

SCMD CyberSuite

Clients · NDA

The cybersecurity file of a regulated product, kept current from live data instead of rewritten for every audit.

Question
Can the cybersecurity documentation of a medical device update itself when a dependency changes, instead of being rewritten by hand before each submission?
Result
That is what it does. Inventory, vulnerabilities, risks and documents live in one place, and an approved document can be reproduced exactly years later. Available to clients under NDA.

Security platform

Go · PostgreSQL · Vue · Electron

Tmux Opener

Works

Your tmux sessions, local or over SSH, one click away in iTerm.

Question
Can the long ssh-and-tmux command you keep digging out of your shell history become a button?
Result
Yes. Each session is a card. Click it and iTerm connects and attaches, creating the session if it doesn't exist. Version 1.0 is out, also through Homebrew.

Desktop app

Swift · SwiftUI

Patrulla del Río

App Store soon

A 1982-style arcade game for iPhone. Fly upriver, blow up the bridges, watch the fuel.

Question
Does an arcade game from the eighties still hold up on a phone, with no ads and nothing to buy?
Result
We think so. The whole game is HTML5 inside a native app that works offline and vibrates when you crash. Coming soon to the App Store.

Game

HTML5 canvas · SwiftUI

Tumbix

On the App Store

A block puzzle with real gravity, for iPhone and iPad.

Question
Can we take a small puzzle all the way to the App Store with no ads, no accounts and no data collected?
Result
Yes. Tap a group of blocks of the same colour and the rest fall into place. It's on the App Store.

Game

Swift · SwiftUI

PlumaCode

In progress

A native code editor, with Markdown you edit on the rendered page.

Question
Can a code editor open instantly, handle a 100 MB file and edit Markdown on the rendered page, without Electron?
Result
Work in progress. The tests already check that a 100 MB file opens without freezing the window and that typing stays under 16 ms. Not released yet.

Desktop app

C++20 · Qt 6 · Scintilla

Log

What happened on the bench, newest first.

  1. The lab gets its own address: lab.securecmd.com.

  2. EXP 07PlumaCode packages as a universal macOS app and shows up in Finder’s “Open With” menu.

  3. EXP 06Tumbix is on the App Store. Its website now links there.

  4. EXP 07PlumaCode starts: C++ and Qt, no Electron, with the CommonMark spec as part of its test suite.

  5. EXP 06Tumbix starts: a block puzzle for iPhone and iPad, written in Swift.

  6. EXP 05Patrulla del Río: the river, the bridges, the fuel gauge. Then a native wrapper so it plays offline on iPhone.

  7. EXP 03CyberSuite assembles the submission package: the FDA, MDR or CRA structure, with the approved documents, a signed SBOM and VEX, and checksums.

  8. EXP 04Tmux Opener 1.0.0 is out on GitHub.

  9. EXP 03CyberSuite starts the way regulated software should: requirements, architecture and data model written and approved before the first line of code.

  10. EXP 02nander: a file manager for the browser, with users, previews and share links.

  11. EXP 01cobiserver: our own KOReader sync server, packaged as Docker, systemd and .deb on the first day.

House rules

  1. A question first.

    Every experiment starts with one, written down. It is on its card, next to what came out.

  2. Honest status.

    Every card says where the thing stands: works, in progress, in the App Store, or only for clients. No vapourware dressed as product.

  3. Source linked when it’s public.

    Open-source experiments link to their repository. Private ones say so, and you can ask us about them.

  4. Nothing watching you.

    No ads, no trackers, no accounts unless the thing needs one. This site has no analytics and sets no cookies of its own.