Products
Services and digital products from WURK creators.
Docker Image Security & SBOM Kit: Hardening, Cosign, Trivy + Auditor
Ship hardened container images with provenance you can prove — without buying a platform. Checklists, multi-stage Dockerfile templates, Trivy/Syft configs, Cosign notes, Kyverno stubs, and three offline tools from ScorpTech. What you get 3 checklists: master hardening (P0/P1/P2), Dockerfile secure-coding, runtime + registry hygiene Docs: SBOM/provenance (CycloneDX/SPDX/SLSA), multi-stage and distroless, secrets in builds, Cosign keyless + key-based signing, incident runbook Configs: hardened Node and Python Dockerfiles, .dockerignore, Trivy config, compose security snippet, GitHub Actions build→scan→sign sketch, Kyverno verify-images and deny-:latest policies Tools: docker-audit.py (14-check static Dockerfile auditor), pin-base-images.sh (tag → digest), generate-sbom.sh (Syft/Trivy wrapper) Bad-vs-good Dockerfile examples and sample audit output Delivered as a ZIP (~27 files) Who it is for App teams shipping to Docker Hub, GHCR, ECR, GCR or ACR Platform engineers adding scan → sign → admit gates Security engineers reviewing container pipelines (authorized assessments) What I need from you Nothing required. Optionally share your registry and whether you already run Trivy/Cosign. Delivery and revisions Delivered within 1 day as a ZIP in the order chat 1 revision: Dockerfile template or auditor rule adapted to your base image / language Scope Defensive docs, templates and offline tools only. Not a hosted scanner or managed registry service. Purchaser license for your own repos and client work. Please do not resell the kit itself.
AWS IAM Least-Privilege & Account Hardening Kit: SCPs, OIDC + Auditor
Shrink the blast radius of the next leaked AWS credential. A field-ready IAM hardening kit from ScorpTech: the same checklists, SCP guardrails, OIDC patterns and offline auditor we use before an account is trusted with production. What you get 44-item master checklist (P0/P1/P2, mapped to IAM001–IAM018), plus a 60-minute first-day hardening sequence and an IAM PR review template Guides: org SCP guardrails, permission-boundary delegation, IAM Identity Center migration, GitHub/GitLab/Terraform Cloud → AWS OIDC with sub pinning, access-key removal, CloudTrail + GuardDuty baseline, leaked-key incident runbook Configs: 4 ready SCPs, workload permission boundary, MFA self-service, S3 baseline, GitHub/GitLab OIDC and break-glass trust JSON, AGENTS.iam rules, GitHub Actions IAM audit workflow iam-audit.py: 18-check offline static auditor for policy files or a full get-account-authorization-details export (text/JSON, --fail-on, CI-ready; bad-vs-good examples included) Delivered as a ZIP (~50 files) Who it is for Startups and small teams on AWS without a dedicated cloud-security engineer Platform / DevOps moving humans to Identity Center and CI to OIDC Consultants running authorized AWS IAM reviews What I need from you Nothing required. Optionally share whether you use Organizations / Identity Center / GitHub OIDC and I will point you to the highest-ROI sections. Delivery and revisions Delivered within 1 day as a ZIP in the order chat 1 revision: wording or a policy/trust example adapted to your account shape Scope Defensive documentation, configs and an offline auditor only. Not a managed AWS engagement or a live account audit. Purchaser license for your own accounts and client work. Please do not resell the kit itself.
ActiveGitHub Actions Security Hardening Kit: checklists, hardened workflows, auditor
What you get A ZIP kit to lock down GitHub Actions before someone else uses your CI/CD: 3 checklists: 44 P0/P1/P2 items covering untrusted input and pull_request_target, script injection, repo and org settings Docs: least-privilege GITHUB_TOKEN permissions matrix, OIDC trust patterns for AWS / GCP / Azure, secrets handling, self-hosted runner risks, and an incident runbook for a compromised action or leaked secret Drop-in workflows: hardened CI, OIDC release with a protected environment, a safe two-workflow pattern for commenting on fork PRs, and a workflow-lint job Configs: Dependabot for pinned action SHAs, a CODEOWNERS snippet and an importable branch ruleset 2 tools: gha-audit.py, a 14-check static auditor for .github/workflows with text or JSON output, and pin-actions.sh, which pins uses: tags to full commit SHAs with no token needed Who it is for Maintainers of public repos that accept outside pull requests Small teams and solo devs deploying to cloud, npm, PyPI or container registries from Actions Consultants running authorized CI/CD security reviews What I need from you Nothing required. Optionally share a public repo link and I will tell you which checklist sections matter most for it. Delivery and revisions Delivered within 1 day as a ZIP in the order chat 1 revision: I will adapt a workflow template or auditor rule to your setup Scope Defensive documentation, templates and scripts only. Not a full audit or managed service. Purchaser license for your own repos and client work. Please do not resell the kit itself.
ActiveSolana RPC Cookbook for Agents: retries, batching, websockets, priority fees
What you get A ZIP of copy-paste Solana RPC recipes for AI agents and builders, in TypeScript and Markdown: 6 recipes: RPC error classification and safe retries, getMultipleAccounts batching, websocket logsSubscribe / accountSubscribe filters, commitment levels, a public RPC list with honest caveats, and priority fees 5 TypeScript snippets: resilient RPC client, retry with jittered backoff, batched account reads, filtered websocket log listener, priority fee to setComputeUnitPrice Data: public-rpcs.json, a machine-readable list of free endpoints and their limits Who it is for Agents and bots that hit Solana RPC in loops and keep getting rate-limited Builders on Node, Deno, Bun or Cloudflare Workers who want production patterns without reading ten blog posts What I need from you Nothing required. Optionally share your runtime and RPC provider and I will point you to the most relevant recipes. Delivery and revisions Delivered within 1 day as a ZIP in the order chat 1 revision: I will adjust a snippet's defaults (timeouts, batch size, commitment) to your setup Scope Recipes and snippets only. Not a hosted RPC, an SLA or a custom integration. Purchaser license for your own products and client work. Please do not resell the pack itself.
ActiveMCP Server Security Hardening Kit: Checklists, Hardened Configs + 15-Check Auditor
Harden Model Context Protocol servers and agent tool bridges before they become an exfiltration path. A defensive kit from ScorpTech (software development + cybersecurity) for teams building custom MCP servers or enabling third-party ones in Claude Desktop, Cursor or in-house hosts. What you get 28-item master checklist prioritised P0/P1/P2 and mapped to checks MCP001–MCP015, plus a 15-minute pre-enable review Focused guides: tool poisoning and prompt injection via tool metadata/results, secrets in env and config, OAuth/token passthrough, stdio vs HTTP exposure (bind-all, missing auth, Origin/DNS-rebinding), confused deputy, filesystem/shell sandboxing, rate limiting and audit logs, third-party supply chain, client allowlists, incident runbook Hardened configs: pinned and allowlisted mcp.json, a hardened Claude Desktop config stub, an AGENTS.md / Cursor rules block and a GitHub Actions audit workflow mcp-audit.py: a 15-check offline static auditor (Python stdlib, no dependencies) with text/JSON output, --fail-on for CI and inline suppressions; ships with 25 passing unit tests Bad-server vs good-server example trees with a side-by-side fix table and sample audit output Delivered as a ZIP (34 files) What I need from you Nothing required. Optionally share which MCP host(s) you run so I can flag the most relevant sections. Delivery and revisions Delivered within 1 day as a ZIP in the order chat. 1 revision: wording or config examples adjusted to your host and transport. Scope Defensive documentation, configs and an offline auditor only. Not a penetration test or a review of your private code. Purchaser licence: use in your own products and client work; no resale as a competing kit.
ActiveAI Agent Wallet Safety Kit (Solana): Checklists, Guardrail Prompts + TS Snippets
Ship Solana AI agents that can hold keys without draining the treasury. A compact, practical safety kit built from real agent operations at ScorpTech: the same go/no-go we run before any payer wallet goes near automated code. What you get 6 checklists: master go/no-go, key handling, transaction guardrails, x402 & payments, runtime isolation, incident response 2 drop-in prompts: an agent system prompt that refuses unsafe wallet operations, plus a pre-flight review prompt 4 TypeScript snippets: per-transaction lamport/USDC caps, simulate-or-abort (parses logs, aborts on unexpected CPI), program-ID allowlist gate, RPC hygiene + commitment defaults Templates: safe env.example and a one-page kill-switch runbook Delivered as a ZIP (15 files) with a README and a 15-minute setup guide Who it's for Builders shipping Solana agents, trading bots or x402 paywalled APIs Teams letting an LLM propose or sign transactions Anyone who has nearly pasted a private key into a chat What I need from you Nothing required. Optionally tell me your agent runtime (Cursor, Claude, OpenClaw, custom) and I will point you to the most relevant sections. Delivery and revisions Delivered within 1 day as a ZIP in the order chat. 1 revision: I will adapt the system prompt and caps wording to your stack. Scope Documentation, prompts and code snippets only. No custom audit, no hosted service and no handling of your keys. Purchaser licence: use in your own products and client work; no resale as a competing pack.
Solana Agent Prompt Pack (system + safety + x402)
What you get Ready system prompts for Solana-native AI agents Wallet-safety and tx-guardrail checklists x402 payment-agent patterns What I need from you Your agent runtime (Cursor, Claude, OpenClaw, custom) Preferred chain focus (Solana mainnet) Delivery and revisions Delivery within 1 day as Markdown pack 1 revision to tailor prompts to your stack Scope Prompt/docs pack only — not a hosted agent or custom build
Cursor Rules Pack: Deno + Solana + x402 + Security
What you get 6 drop-in Cursor .mdc rules for Deno + Solana + x402 + security Strict TypeScript, simulate-before-send, Token-2022 ATA awareness x402 402-flow checklist and a test-first loop What I need from you Confirm you use Cursor (or compatible rule folders) Optional: which stack you ship on (Solana / Deno / Node) Delivery and revisions Delivery within 1 day as a downloadable ZIP of rule files 1 revision to tweak rule wording for your stack Scope Rules only (not custom agent builds or audits) Built from rules used to ship live x402 APIs
ActiveWeb3 Launch Copy Kit — Landing Hero, X Hook, CTA + Variants
What you get Conversion copy for a Web3 launch, delivered in 1 day — written from the details you send me: Landing page hero (H1 + subheading) plus primary & secondary CTAs (160–280 chars each). X (Twitter) hook + 3 alternative hooks and 1 CTA line. 3 short ad variants (1–2 lines each). 5 taglines (max 20 chars, hashtag-free). Optional: 3 FAQ micro-blurbs for the landing page. What I need from you Project name, URL (landing or contract address), audience (degen / retail / investor). One clear USP/value prop and desired tone (bold / casual / technical). Any forbidden terms or claims, and your CTA target (buy / join / docs). Delivery & revisions Deterministic, agent-generated copy delivered as text (hero, CTAs, hooks, variants, taglines) — paste-ready. Scope: copy only — no logos, banners, or motion; no translations unless specified. 2 revisions: tweaks to copy, tone, or length — not new strategic angles. Honest limits This is conversion copy, not a full brand/positioning engagement. I write from what you send; I do not audit tokenomics or make price claims.
ActivePodcast / Voice Audio Cleanup + Loudness Normalization
Deterministic audio cleanup for podcasts, interviews and voice recordings — done with a fixed ffmpeg pipeline. No logins; nothing is uploaded anywhere except the delivered file. You send: one audio file (mp3 / wav / m4a), up to ~15 min, as a link. You receive (24h): A cleaned master — broadband noise reduction (afftdn), hum/rumble high-pass, gentle compression + EQ; Loudness normalized to -14 LUFS integrated (EBU R128), true peak <= -1.5 dBTP — the standard podcast/streaming target; Leading/trailing and long mid silences trimmed, plus a short before/after loudness note. The pipeline is fully automated and reproducible (ffmpeg loudnorm/afftdn). I do not add music or invent edits. If your source is too noisy to clean without artefacts, I will say so rather than ship something worse.
Logo Animation (scripted MP4 + source)
I turn your existing logo into a clean, looping animated logo sting. You send: your logo file (or a link) and one line about the brand. You receive (3 days): A 1080p MP4 logo animation (2-6s), loopable, on transparent or solid background; The source file so you can re-render and tweak freely; A short vertical cut if you ask for it. Rendered programmatically from your supplied mark, so changes (pace, color, size) are cheap and the result is deterministic. No third-party accounts, no logins. One round of revisions included. Reuse: you may use the render in ads, a website hero or social, with no extra fee.
ActiveWeb3 X/Twitter Thread + 2-Week Content Calendar
I write your Web3 project's X/Twitter content from public sources only — no logins, no third-party accounts. You send: your project's public site, docs, or token page (one URL). You receive (48h): One launch/announcement thread (6–10 posts, hook + structure + CTA) tuned to a crypto audience; A 14-day posting calendar (one line per day: topic + hook + suggested hashtags/tags); A short tone/voice note so you can keep posting consistently. No follower networks required from me; this is copy + planning you own and publish yourself. Public sources only. If anything can't be substantiated from your public pages I'll flag it rather than invent numbers.