diff --git a/README.md b/README.md
index a10f052..f5a4b8c 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ sudo nixos-rebuild switch --flake.#thonkpad
 - [hlissner](https://github.com/hlissner/dotfiles) (also uses bspwm)
 
 # For if you're not me
-My setup is designed for (1) [academic research](https://jakegines.in/research) in my PhD, and (2) security research, in my work as a cryptographic auditor. I would highly recommend *not* (not) installing this bare and trying to figure out my system. Read my system manually and pick out the parts you're interested in. 
+My setup is designed for (1) [academic research](https://jakegines.in/research) in my PhD, and (2) security research, in my work as a cryptographic auditor. I would highly recommend *not* (not) installing this bare and trying to rawdog figure out my system. Read my system configuration manually and pick out the parts you're interested in. 
 
 Some subtleties about my setup:
 - tailscale and syncthing are automatically set up. my note system is integrated with the OS itself with [nf](https://github.com/JakeGinesin/nix-dots/blob/master/home/scripts/journal/nf.sh), alacritty, and rofi. syncing of notes between my server, my phone, and my computer(s) is fully automatic, bootstrapping from the agenix'ed API keys
diff --git a/home/home.nix b/home/home.nix
index fdb2a3d..5735ffe 100644
--- a/home/home.nix
+++ b/home/home.nix
@@ -130,6 +130,8 @@ in {
       dhcpcd
       wireshark
       postman
+      nuclei
+      subfinder
     ]
     ++ (
       with lib; let
diff --git a/home/scripts/security/sg.sh b/home/scripts/security/sg.sh
new file mode 100644
index 0000000..87fc9a0
--- /dev/null
+++ b/home/scripts/security/sg.sh
@@ -0,0 +1 @@
+semgrep --config=p/cwe-top-25 --config=p/owasp-top-ten --config=/home/synchronous/extras/semgrep-rules --exclude '*example*' --exclude '*test*' --severity ERROR -- .
diff --git a/home/scripts/security/sub-to-ip.sh b/home/scripts/security/sub-to-ip.sh
new file mode 100755
index 0000000..f0d35fc
--- /dev/null
+++ b/home/scripts/security/sub-to-ip.sh
@@ -0,0 +1,33 @@
+if [ -z "$1" ]; then
+  echo "Usage: $0 domain.com"
+  exit 1
+fi
+
+DOMAIN="$1"
+OUTPUT_FILE="ips.txt"
+SUBS_FILE="subs.txt"
+
+echo "[*] Enumerating subdomains for $DOMAIN..."
+subfinder -silent -d "$DOMAIN" -o "$SUBS_FILE"
+
+if [ ! -s "$SUBS_FILE" ]; then
+  echo "[!] No subdomains found or subfinder failed."
+  exit 1
+fi
+
+echo "[*] Resolving IPs..."
+> "$OUTPUT_FILE"
+
+while read -r sub; do
+  ips=$(dig +short "$sub" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$')
+  if [ -n "$ips" ]; then
+    for ip in $ips; do
+      echo "[+] $sub resolved to $ip"
+      echo "$ip" >> "$OUTPUT_FILE"
+    done
+  else
+    echo "[-] $sub did not resolve"
+  fi
+done < "$SUBS_FILE"
+
+echo "[*] IPs saved to $OUTPUT_FILE"
diff --git a/home/scripts/security/subenum2.sh b/home/scripts/security/subenum2.sh
new file mode 100755
index 0000000..98d9019
--- /dev/null
+++ b/home/scripts/security/subenum2.sh
@@ -0,0 +1,7 @@
+if [ -z "$1" ]; then
+  echo "Usage: $0 <domain>"
+  echo "Example: $0 example.com"
+  exit 1
+fi
+
+subfinder -silent -d $1
diff --git a/home/scripts/security/testssl.sh b/home/scripts/security/testssl.sh
new file mode 100644
index 0000000..0dfd9e8
--- /dev/null
+++ b/home/scripts/security/testssl.sh
@@ -0,0 +1,7 @@
+# https://github.com/testssl/testssl.sh
+if [ -z "$1" ]; then
+  echo "Usage: $0 <domain>"
+  echo "Example: $0 example.com"
+  exit 1
+fi
+docker run --rm -it ghcr.io/testssl/testssl.sh $1
diff --git a/home/scripts/security/truffle.sh b/home/scripts/security/truffle.sh
new file mode 100644
index 0000000..03adfcc
--- /dev/null
+++ b/home/scripts/security/truffle.sh
@@ -0,0 +1 @@
+docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest filesystem .