I am Jainam H. Maru, a security researcher, OS developer, and full-stack engineer. I build AI-powered defensive tooling and study attacker behavior. My focus sits at the intersection of threat intelligence and machine learning.
- Threat intelligence collection: honeypots, dark-web OSINT, MITRE ATT&CK mapping
- Dark-web OSINT and entity resolution: building DarkForce - Tor and clearnet collection, actor correlation, interactive relationship graphs
- Zero-Trust architecture: CISA ZTMM-aligned labs with OPA, oauth2-proxy, mTLS
- SIEM engineering: building CyberRakshak (Smart India Hackathon) - Windows Event Log ingestion, correlation rules, MITRE-mapped detection, live SOC dashboard
- AI engineering: LLM-assisted analysis (Ollama, Groq), ML malware detection with SHAP explainability
- Education systems: building EduOS, an open-source operating system for education, secure exams, and cyber training
I document, CI-test, and open-source everything I build.
| Project | What it does | Stack |
|---|---|---|
| darkforce live | Dark-web threat intelligence platform OSINT collection across Tor & clearnet, actor entity resolution, and an interactive relationship graph that dims filtered nodes instead of reflowing the layout | Python FastAPI React 19 Cytoscape.js SQLite Tor |
| aegis-nexus-ai | Security operations command center - FastAPI + React, modular feature-first architecture, audit chain, risk scoring | Python - FastAPI - React 19 - TanStack Query - SQLite |
| CyberRakshak | SIEM platform for CRPF units (SIH 2026) agent-based Windows Event Log collection, correlation + MITRE ATT&CK detection, role-based live SOC dashboard | Python FastAPI Next.js 15 SQLAlchemy SSE |
| eduos | Unified OS for learning, secure examinations, cybersecurity training & campus admin | Python PyQt6 FastAPI FreeBSD |
| ssh-honeypot | AI-driven SSH deception captures attacker commands, geolocates, scores threat, maps to MITRE ATT&CK | Python Paramiko Ollama Docker |
| zero-trust-lab | CISA ZTMM 2.0 lab nginx + oauth2-proxy + OPA + authz-bridge across 4 VMs | Docker OPA Authentik WireGuard |
| malware-detector | PE malware detector YARA + Random Forest + EMBER 2381 features + SHAP | Python FastAPI scikit-learn |
| crpf-soc-dashboard | SOC command-centre prototype centralized security monitoring for CRPF (SIH) | React FastAPI Recharts |
| bitchat-messenger | Real-time chat messenger | JS WebSockets |
| password-cracker-toolkit | Industrial-grade cracking suite masks, rules, combinator, sessions | Python CUDA |
-109-00FF41?style=for-the-badge&labelColor=0d1117){kind=icon}
| Project | Contribution | Status |
|---|---|---|
| beeware/toga | Fix AsyncResult.__bool__ so truthiness raises the helpful exception message |
#4632 merged |
| pschanely/CrossHair | Fix keyword-only arg crash, max_iterations=0 NameError, and format_boundargs TypeError |
#501 merged |
| Nayjest/GITO | Fix None crashes in answer(), cmd_answer, and deploy --commit |
#318 merged |
| lissy93/web-check | Typos/grammar/broken-links fixes | #314 merged |
| OWASP/CheatSheetSeries | Grammar fixes on SQL Injection Prevention Cheat Sheet | #1549 merged |
| spore-host/spawn | Skip unassociated EIPs annotated aws:* in reconciler |
#554 merged |
| jupyterhub/kubespawner | Fix implicit string concatenation breaking singleuser_lifecycle_hooks deprecation |
Open #933 |
| beeware/toga | Don't orphan SplitContainer content on invalid assignment | PR #4633 |
| lissy93/web-check | Skip public API calls for non-routable IPs; add SECURITY.md | PRs #320, #322 |
| scanapi/scanapi | Migrated pytest-freezegun time-machine | PR #1011 |
| sherlock-project/sherlock | DNS/Discord.bio/interpals false positives; --output no-rewrite; per-username counter reset; location-parse crash |
PRs #3080, #3083, #3084, #3085, #3094 |
| ossf/cve-bin-tool | Performance optimizations trimmed test lockfiles, lazy DB init | PR #5857 |
| xynehq/xyne | Skip empty Docling image chunk descriptions | PR #1365 |
| orkestra-cc/orkestra | rustfs backup/restore check-sync fix | PR #304 |
| common-workflow-language/cwltool | Fix resolve_local returning CWD-anchored URIs |
PR #2325 |
| aquasecurity/trivy-checks | Use glob patterns for TLS policies (AWS-0112 + AWS-0126) | PRs #606, #607 |
| chubin/wttr.in | Serve localized 404 page for unknown locations | PR #1292 |
| beefproject/beef | Fix URL-encoded command passed to shell execution modules | PR #3637 |
| andyjmorgan/slipspace-gateway | Clarify Last4 contract for short secrets in redact() |
PR #562 |
| getaxonflow/axonflow | Complete the examples index in examples/README.md |
PR #462 |
| qeeqbox/social-analyzer | Fix typos in CLI options and install instructions | Closed |
| donnemartin/system-design-primer | Fix typo: "Graphs databases" "Graph databases" | Closed |
| OWASP/Nest | Fix /repositories sitemap lastmod to use latest repository update |
Closed |
| OWASP/CheatSheetSeries | Add password cracking techniques to Password Storage Cheat Sheet | Closed |
| pypsa-meets-earth/pypsa-earth | Exit after writing empty hydro profile to avoid NameError on inflow | Closed unmerged |
| garagehq/nightcrawler | Catch loud nmap under sudo prefix during training-data cleanup | Closed unmerged |
| fastapi/fastapi | Security best practices documentation | Closed |
"Code with intention. Secure with ethics." Jainam H. Maru
Monthly Profile Views (Total: 962)
| Month | Start | Peak | End | Growth |
|---|---|---|---|---|
| 2026-09 | 889 | 962 | 962 | 73 |
| 2026-08 | 521 | 866 | 866 | 345 |
| 2026-07 | 196 | 503 | 503 | 307 |