Kits
The tools on this site are free and stay free. These kits are the extra pieces I build around them: tested scripts, config files, runbooks and exercises you can use the same day. Each one is a one-time purchase on Gumroad, delivered as a zip of plain files. No account, nothing that phones home.
sudodrift All Access, $49
All 13 paid sudodrift kits in one purchase, worth $190 if bought separately. Every file from every kit, downloaded from your Gumroad library, plus kits added to the bundle as they release.
Free: 48 Linux Security Commands to Check Any Server
A free 2 page cheat sheet with the commands I use most when checking or locking down a server: users and sudo, processes, ss, journalctl, SUID, SSH, nftables and ufw, and incident checks. PDF plus Markdown. Pay what you want, $0 is fine.
sudodrift Pro Pack, $24
A 27-item Linux access hardening checklist, tested sudoers.d and sshd_config.d files, a quarterly access review kit for SOC 2 and ISO 27001 style reviews, and four bash scripts for collecting sudodrift snapshots across many hosts.
sudodrift Pro, $15
Turns two sudodrift snapshots into an audit evidence pack for Linux access reviews: a printable report with a sign off box, CSVs of changes, root capable accounts and SSH keys, SOC 2 and ISO 27001 control references, and checksums.
phishpeek Pro, $9
Offline phishing reports from saved .eml files: an HTML report for one email, a worst first scan of a whole folder, and JSON for help desk tools. It never opens links or looks anything up.
Linux Intrusion Triage Kit, $17
For the moment you think a Linux box has been broken into. A read-only bash collector, 16 persistence checks, baseline drift, a first-hour runbook and rebuild and key rotation checklists. Tested against 17 planted backdoors.
Dev and Ops Tabletop Pack, $19
Six tabletop exercises with 35 timed injects for small tech teams: a leaked key, a swapped release, an AI agent gone wrong, a Linux backdoor, an admin inbox takeover and a backup wipe. Facilitator notes and a scoring workbook included.
Restore Drill Kit for Linux, $14
Prove your backups actually restore. Timed pass or fail drills for restic, borg, tar, rsync copies and PostgreSQL dumps, with evidence records and a report of drills that are overdue.
Agent Guardrails Pack, $12
Hooks for Claude Code and Cursor that block secret file reads, force pushes, piping curl into bash and payment tool calls. One Python file, strict, normal or audit mode. Pairs well with the free agent-preflight.
SSH Certificate Kit for Small Fleets, $12
Stop copying authorized_keys to every server. A small wrapper around OpenSSH ssh-keygen for short-lived user and host certificates, revocation lists, a server drop-in bundle and a rollout runbook.
Vault Compromise Response Kit, $15
For when your password vault, PAM tool or remote support server may have been reached. A blast radius inventory, a tiered rotation order, session and MFA security key review checklists for Entra ID, Okta, Google Workspace, AWS and GitHub, a 72 hour timeline and message drafts.
14 Linux Security Cheat Sheets, $9
One page references for triage, SSH, sudo, nftables, ufw, auditd, systemd, openssl, Docker and AWS IAM. Command on the left, what it tells you on the right, plus the trap that catches people. Print and dark PDFs plus Markdown.
M365 Account Compromise Kit, $15
Contain a hijacked Microsoft 365 mailbox in the first hour. An ordered checklist, a read-only evidence script, offline audit log triage, payment fraud steps and message drafts.
Canadian Privacy Evidence Pack, $15
PIPEDA evidence in one afternoon for small Canadian teams. A breach record log, a RROSH decision guide, an access request log with 30 day tracking, a personal information inventory, policies and an offline log checker.
Linux Security Interview and Hardening Labs, $14
Pass the Linux security interview. 40 questions with model answers and red flags, plus 8 self checking hardening labs (SSH, sudo, nftables, auditd, sysctl) you run on a throwaway VM.
Annotated Hardened Config Baselines, $12
4 hardened baselines for nginx, OpenSSH, Docker and GitHub Actions, every line explained, plus a checker that flags risky settings in your own config files.
Access, Vendor and Vulnerability Trackers, $12
3 security review trackers for Excel and Notion: access reviews, vendor risk and vulnerability SLAs, with a dashboard and scripts that flag leavers and CISA KEV hits.
Questions about a kit before you buy? Open an issue or reply to any Weekly Breach Notes email.