Projects | Nick Strupp

Security work

United States Patent

US 11,106,801 B1

Granted August 31, 2021

US Patent 11,106,801: orchestration and augmented vulnerability triage for software security testing

Co-inventor · Accenture Global Solutions

One of the core challenges in application security is that scanning tools produce enormous volumes of findings but no context to act on them intelligently. This patented system solves that by combining orchestration with augmented triage: automatically enriching vulnerability data with contextual, experiential, and industry threat intelligence, then applying machine learning models to confirm real security issues and drive prioritized remediation actions.

As a named co-inventor on this patent, I contributed to the design of a system that reduces the manual burden on security analysts and turns raw scan data into actionable, prioritized outcomes. The approach reflects how I think about vulnerability management at scale: the goal isn’t more data, it’s better decisions, faster.

View US Patent 11,106,801 →

The FlintScope home page: a dark page headed “Stand up a risk-based VM program in weeks” above a table ranking six findings by CVSS and by real risk.

FlintScope: risk-based vulnerability management programs

Founder · Since December 2024

Most vulnerability management programs sort work by CVSS because that’s what the scanner hands them, and the policies, SLAs and reports all follow. FlintScope is where I write down the alternative in full: rank findings by whether they’re being exploited, whether they’re reachable, and how much the system matters.

The VM Program Kit is a complete, openly licensed program: policy, a two-stage prioritization model, triage and remediation runbooks, an executive metrics dashboard, and a crosswalk to NIST CSF 2.0, PCI DSS v4.0.1, ISO 27001:2022 and SOC 2. The site also has free tools such as KEV Check, which tells you whether a CVE is on CISA’s known exploited list and whether it passes the gate.

Visit flintscope.com → Get the free Kit →

What First in play: a grid of rooms in a dental office, such as patient records computer, backup drive and card terminal, each showing a count of security problems.

What First: a vulnerability triage game

FlintScope project · TypeScript, static site

Small business owners hear that they should “fix their vulnerabilities” but never that they can’t fix all of them. What First makes that point in five minutes: pick a business (a dental office, a machine shop or an online store), get thirty security problems and a budget for five fixes a quarter, and watch hidden dice decide which of the rest get exploited.

At the end you see how your year went and how it would have gone with a different order. It runs entirely in the browser with no accounts and no tracking. The lesson: you can’t fix everything, so the order is the whole game.

Play it → View on GitHub →

Selected software

The MedTags home page, headed “What a stranger needs to know, one tap away,” beside illustrated keychain tags reading Jamie, Nonverbal, with a QR code.

MedTags: medical information on a keychain

Live service · PHP 8, MySQL

Medical ID jewelry has room for a word or two. A MedTag is a small NFC and QR keychain tag that links to a whole page its owner writes and keeps up to date: how to communicate with them, what they take, what they’re allergic to and who to call. Whoever is helping just taps it with a phone; no app is needed.

It’s a live service on plain PHP 8 and MySQL with no framework: owner sign-in and editing, an admin side for generating tags in bulk and writing the NFC chips, printable tag sheets, nightly backups, and an uptime check that uses a real tag. The same tags also work on pet collars as lost-pet pages.

Visit medtags.org →

AcreLog: farm equipment maintenance and fleet management

Android app · React Native, Firebase

Farmers don’t have time to dig through spreadsheets to figure out when the tractor is due for an oil change. AcreLog tracks equipment from the field, not the office: fleet records with photos and hours, hour- and date-based maintenance schedules with overdue alerts, maintenance logs, downtime tracking, and PDF maintenance histories for when it’s time to sell.

It supports multiple farms, QR code team invites and role-based access (Owner, Manager, Worker, Auditor) enforced by Firestore security rules at the database level. A web version in React and TypeScript shares the same data. I designed and shipped it end to end with Claude Code.

View on GitHub → Open the web app →

A driver’s hands on a steering wheel, looking down a city road at sunset.

ReadyToRoll: supervised driving hour tracker

Progressive web app · Single HTML file

Every US state requires supervised driving hours before a teen can get a license, and tracking them usually means paper logs. ReadyToRoll records each drive with its GPS route, weather and day or night conditions, gives parents a read-only link to follow along, and prints a DMV-ready log with supervisor signatures.

It’s a single HTML file with no framework and no backend. It works offline through a service worker, syncs between devices with an 8-character code, and has all 50 states’ hour requirements built in, with no account or install needed.

Try it → View on GitHub →

Also built

Print Pricer: 3D print quoting tool

Browser app · JavaScript, Firebase

Drop in a .gcode or .3mf file and it fills in print time and filament weights, then prices electricity, machine time, failures and margin. Spool inventory, printer presets and a quote archive.

Try it → View on GitHub →
Sound Shelf: sound effects for a middle-school class

Volunteer project · Python, Docker, static site

1,644 free CC0 sounds for students building MIT App Inventor apps at a school that blocks most sound sites, plus an email bot on my home lab that turns YouTube links into trimmed MP3s.

soundshelf.org →
County Fire Dispatch: a 911 simulator with an AI caller

In progress · React, TypeScript, Claude API

A large language model plays a confused caller who only partly knows what’s happening. The simulation decides the truth first and the model only sees its character’s view, so it can’t leak the answer.
Bloodied: D&D encounter builder and combat tracker

Progressive web app · React 19, TypeScript, IndexedDB

The full SRD 5.2.1 monster library, encounter budgets for the 2024 rules, and a combat tracker with separate views for a TV and players’ phones. Works offline.

Open it →
GroveMinder: booking site template

Template · Firebase, PHP

Availability and booking for one-person businesses, with an admin panel, Firestore rules that only accept well-formed pending requests, and iCal calendar sync. One config file per site.

See the demo → View on GitHub →
Donuts for Steven: kid-friendly match-3 game

Android game

A no-pressure puzzle game I built for my nephew Steven, who has cerebral palsy: no timer, no move limit, no score to chase, with power-ups and four themes.

View on GitHub →
Letter Tracer: handwriting practice for kids

Web app · Single HTML file

Trace dotted letters with a finger or stylus on a phone or tablet, with guide lines, adjustable line thickness and color themes.

Try it →