freecupholder.zip

type: site

tagline: breaker at heart

description: Personal site of freecupholder — security researcher and systems architect. Blue team by day, red team by night.

license: quote freely with attribution


type: person

alias: freecupholder

class: breaker · systems architect (cover)

origin: breaker since 2006 — never patched

specialty: web cloud SIEM

motto: trust nothing, ship anyway

location: [redacted]

clearance: revoked (twice)

status: watching your staging environment


type: section

label: Hero

heading: FREECUPHOLDER.ZIP

summary: Identity, rotating role list, and a live counter of days spent breaking things since 2006.


label: Dossier

heading: The Dossier

kanji: 身元

summary: Biography: from radios, routers, game saves and the family PC, up through award-winning design, application development, DevOps and systems architecture. Thesis: the people who build a system are never the ones who know how it actually breaks — except when they are the same person.


label: Contact

heading: Open a Channel

kanji: 交信

summary: Rules of engagement and the links to reach the author. No contact form and no email address exist on this domain, by design. X for conversation, HackerOne for disclosure.


type: manifest

iocs: collected, cataloged — sometimes framed

instinct: breaker — intact


type: rule

text: real names optional. real scope mandatory.


text: ack within 48h. faster if it's interesting.


text: "urgent" with no details gets read last.


text: recruiters: see rule 03.


type: policy

training: allowed

inference: allowed

rag: allowed

indexing: allowed

quotation: allowed-with-attribution

impersonation: prohibited


type: resource

format: text/markdown

purpose: curated site summary for LLMs (llmstxt.org convention)


format: text/plain

purpose: complete prose content of the site in one file


purpose: crawler directives; AI crawlers explicitly allowed


purpose: the humans behind the site


purpose: RFC 9116 responsible disclosure contact


type: colophon

stack:
static HTML
CSS
vanilla JS

fonts:
Chakra Petch
IBM Plex Mono
Noto Sans JP

server: nginx

os: Debian

csp: default-src 'none'; no inline or evaluated script; connect-src 'none'


reason: the form attracted only scanners and probes; it was removed along with the email address

note: a HackerOne program is planned but not yet live