Nizar Tuanku builds Hexward Labs: self-hosted Cybersecurity tools for MSPs and network engineers. Single Go binary, SQLite, offline licence check, no telemetry, no phone-home. Every repository below is the free edition — the same engine as the paid tiers, Apache-2.0.
| If you want to… | Open this | See it before you run it |
|---|---|---|
| Migrate a firewall between vendors (ASA / FTD / PAN-OS / FortiGate / Check Point) with every unconverted item listed | RuleForge | Sample conversion report · final migration report |
| Find the shadowed, permissive and drifted rules in a config you already have | RuleHawk | Four sample configs — the ASA one yields 11 findings, 2 high |
| Stop a certificate from taking production down | CertLight | Run it, add a host, results in seconds |
| Read the cross-vendor gotchas without installing anything | Firewall migration notes | FortiGate central NAT |
If one of these saves you an hour, a ⭐ on the repo is how the next engineer finds it.
| Tool | The question it answers | Port |
|---|---|---|
| CertLight | Is our TLS about to expire — or badly configured? | :8422 |
| Attack Surface Monitor | What do we actually expose to the internet? | :8423 |
| Decoy | Is someone already inside? | :8424 |
| Patchlight | Which CVEs are actually exploited — and affect us? | :8425 |
| RuleHawk | Does our firewall still mean what we think it means? | :8426 |
| Loglight | If something were attacking us right now, would we know? | :8427 |
| RuleForge | Can we move this firewall to another vendor without losing a rule? | :8428 |
| DmarcWatch | Who is sending mail as our domain? | :8429 |
| TenantWatch | Is our Microsoft 365 / Google Workspace tenant configured the way we think? | :8430 |
| Posture Report | One score across the whole stack — what is it this week? | :8432 |
| TopoLight | What does the physical network look like right now, and what is the root cause? | :8433 |
| AuditLight | What would an assessor find — before the assessor does? | :8431 |
They work as a system: every tool can emit findings as syslog, and Loglight folds them into kill-chain incidents. Pro and Team tiers (higher limits, more alert channels, team features) are on Whop — all products, 14-day trial, key delivered by DM right after checkout. Running Cisco Secure Firewall? Firewall Operations Platform covers FMC/FTD operations.
Real migrations, real attacks, practical fixes — one mistake per post: Hexward Labs on LinkedIn · YouTube · Documentation hub