/* global React, ReactDOM, useTweaks, TweaksPanel, TweakSection, TweakRadio, TweakToggle */ const { useState, useEffect, useRef, useMemo } = React; /* ---------- VIEWPORT HOOK ---------- */ function useViewport() { const [w, setW] = useState(typeof window !== "undefined" ? window.innerWidth : 1440); useEffect(() => { const on = () => setW(window.innerWidth); window.addEventListener("resize", on); return () => window.removeEventListener("resize", on); }, []); return { w, narrow: w < 1100, tiny: w < 760, mobile: w < 480 }; } /* ---------- THEMES ---------- */ const THEMES = { amber: { bg: "#000000", fg: "#e8e6e1", dim: "#7a7672", rule: "#1a1a1a", panel: "#0a0a0a", accent: "#ffb300", accentDim: "#664700", danger: "#ff4d2e", ok: "#7cff5c" }, cyan: { bg: "#000000", fg: "#e8e6e1", dim: "#7a7672", rule: "#1a1a1a", panel: "#0a0a0a", accent: "#00e5ff", accentDim: "#005966", danger: "#ff4d2e", ok: "#7cff5c" }, red: { bg: "#000000", fg: "#e8e6e1", dim: "#7a7672", rule: "#1a1a1a", panel: "#0a0a0a", accent: "#ff3b30", accentDim: "#5a1410", danger: "#ff3b30", ok: "#7cff5c" }, lime: { bg: "#000000", fg: "#e8e6e1", dim: "#7a7672", rule: "#1a1a1a", panel: "#0a0a0a", accent: "#b6ff3c", accentDim: "#3a5410", danger: "#ff4d2e", ok: "#b6ff3c" }, paper: { bg: "#ece8df", fg: "#0a0a0a", dim: "#6b6660", rule: "#cfc8bb", panel: "#e2ddd1", accent: "#c43c14", accentDim: "#f0c9bc", danger: "#c43c14", ok: "#1f6b1f" }, }; /* ---------- DATA ---------- */ const SERVICES = [ { id: "IR-01", name: "Incident Response", sla: "1h callback · 24/7", scope: "Pre- and post-breach. Containment, forensics, eradication, recovery. Court-ready chain of custody.", tags: ["DFIR", "Ransomware", "BEC", "APT"] }, { id: "MD-02", name: "Managed Detection", sla: "Continuous", scope: "Tech-agnostic MDR layered onto your existing SIEM/EDR. We don't sell you tools — we run yours better.", tags: ["SIEM", "EDR", "XDR", "Cloud"] }, { id: "TH-03", name: "Threat Hunting", sla: "Quarterly + ad-hoc", scope: "Proactive hypothesis-driven hunts against your environment using fresh IOCs from our research desk.", tags: ["MITRE", "TTPs", "OSINT"] }, { id: "RT-04", name: "Retainer & Tabletop", sla: "On-call", scope: "Pre-negotiated IR retainer with executive tabletop exercises, runbook authoring, and breach-coach coordination.", tags: ["Retainer", "Tabletop", "Counsel"] }, ]; const ADVISORIES = [ { id: "HBA-2026-041", date: "2026-04-28", sev: "CRITICAL", title: "Sustained exploitation of CVE-2026-3199 in Atlassian Confluence Data Center", actor: "UNC-RIPSAW", sectors: ["Legal", "Healthcare", "Finance"], reads: "12.4k" }, { id: "HBA-2026-040", date: "2026-04-22", sev: "HIGH", title: "BlackToad ransomware affiliate pivots to MSP supply chain via stolen RMM tokens", actor: "BLACKTOAD", sectors: ["MSP", "Manufacturing"], reads: "8.1k" }, { id: "HBA-2026-039", date: "2026-04-15", sev: "HIGH", title: "Living-off-the-land persistence via Azure Arc onboarding scripts", actor: "STORM-2440", sectors: ["Energy", "Public Sector"], reads: "5.6k" }, { id: "HBA-2026-038", date: "2026-04-09", sev: "MEDIUM", title: "OAuth consent phishing campaign targeting M365 global admins in EU law firms", actor: "MIDNIGHT-OWL", sectors: ["Legal"], reads: "4.2k" }, { id: "HBA-2026-037", date: "2026-04-02", sev: "MEDIUM", title: "Crypto-drainer-as-a-service infrastructure mapped across 14 Telegram channels", actor: "DRAINPIPE", sectors: ["Web3", "Exchanges"], reads: "9.7k" }, { id: "HBA-2026-036", date: "2026-03-25", sev: "LOW", title: "False-positive surge from Defender for Endpoint signature 1.405.221.0 — workaround", actor: "—", sectors: ["All"], reads: "2.1k" }, ]; const STATS = [ { k: "MTTR-median", v: "4.2h", note: "containment, last 90d" }, { k: "Engagements", v: "318", note: "since 2016" }, { k: "Researchers", v: "6", note: "full-time, in-house" }, ]; /* ---------- PRIMITIVES ---------- */ const Rule = ({ v, style }) => { const t = useTheme(); return
; }; const ThemeCtx = React.createContext(THEMES.amber); const useTheme = () => React.useContext(ThemeCtx); function Caret() { const [on, setOn] = useState(true); useEffect(() => { const i = setInterval(() => setOn(o => !o), 530); return () => clearInterval(i); }, []); const t = useTheme(); return ; } function Clock() { const [now, setNow] = useState(new Date()); useEffect(() => { const i = setInterval(() => setNow(new Date()), 1000); return () => clearInterval(i); }, []); const utc = now.toISOString().replace("T", " ").slice(0, 19) + " UTC"; return {utc}; } function SevDot({ sev }) { const t = useTheme(); const c = sev === "CRITICAL" ? t.danger : sev === "HIGH" ? t.accent : sev === "MEDIUM" ? t.dim : t.ok; return ; } /* ---------- LAYOUT BLOCKS ---------- */ function StatusBar() { const t = useTheme(); const { tiny, mobile } = useViewport(); return (
); } function Masthead() { const t = useTheme(); const { narrow, tiny, mobile } = useViewport(); const [menuOpen, setMenuOpen] = useState(false); // close drawer if viewport grows back past tiny useEffect(() => { if (!tiny && menuOpen) setMenuOpen(false); }, [tiny, menuOpen]); // lock body scroll while drawer is open useEffect(() => { if (!menuOpen) return; const prev = document.body.style.overflow; document.body.style.overflow = "hidden"; const onKey = (e) => { if (e.key === "Escape") setMenuOpen(false); }; window.addEventListener("keydown", onKey); return () => { document.body.style.overflow = prev; window.removeEventListener("keydown", onKey); }; }, [menuOpen]); const NavItem = ({ children, href = "#", active, onClick }) => ( {children} ); const openContact = (e) => { if (e) e.preventDefault(); setMenuOpen(false); window.dispatchEvent(new CustomEvent("hb-open-contact")); }; const NAV_ITEMS = [ { label: "services", href: "#services", active: true }, { label: "research", href: "#research" }, { label: "retainer", href: "#retainer" }, { label: "about", href: "#about" }, { label: "detektix ↗", href: "https://detektix.com", external: true }, { label: "contact", href: "#contact", onClick: openContact }, ]; return (
honeybadger/sec {mobile ? "ir · threat research" : "incident response · threat research"}
{tiny && menuOpen && ReactDOM.createPortal(
§ menu
, document.body )}
); } function Logo({ size = 56 }) { const t = useTheme(); const [imgOk, setImgOk] = useState(true); if (imgOk) { return ( Honey Badger Security setImgOk(false)} style={{ display: "block", width: size, height: size, objectFit: "contain" }} /> ); } return ( HB SEC ); } /* ---------- TYPEWRITER ---------- */ // Cycles through the openers: types char-by-char, holds, then backspaces and // picks a different opener. Returns the per-line text plus which line the // caret is currently on. Respects prefers-reduced-motion. function useTypewriterOpeners(openers) { const reducedMotion = useMemo(() => ( typeof window !== "undefined" && typeof window.matchMedia === "function" && window.matchMedia("(prefers-reduced-motion: reduce)").matches ), []); const [openerIdx, setOpenerIdx] = useState(() => Math.floor(Math.random() * openers.length)); const [charIdx, setCharIdx] = useState(reducedMotion ? Number.MAX_SAFE_INTEGER : 0); const [phase, setPhase] = useState("typing"); // typing | holding | deleting const target = useMemo(() => openers[openerIdx].join("\n"), [openers, openerIdx]); useEffect(() => { if (reducedMotion) return; let timeoutId; if (phase === "typing") { if (charIdx < target.length) { const nextChar = target[charIdx]; // mild human-feel jitter; longer beat at line breaks const delay = nextChar === "\n" ? 220 : 30 + Math.random() * 50; timeoutId = setTimeout(() => setCharIdx(charIdx + 1), delay); } else { timeoutId = setTimeout(() => setPhase("holding"), 50); } } else if (phase === "holding") { timeoutId = setTimeout(() => setPhase("deleting"), 2200); } else if (phase === "deleting") { if (charIdx > 0) { timeoutId = setTimeout(() => setCharIdx(charIdx - 1), 18); } else { let next = openerIdx; if (openers.length > 1) { while (next === openerIdx) next = Math.floor(Math.random() * openers.length); } setOpenerIdx(next); setPhase("typing"); } } return () => clearTimeout(timeoutId); }, [phase, charIdx, target, openers, openerIdx, reducedMotion]); const visible = reducedMotion ? target : target.slice(0, charIdx); const lines = visible.split("\n"); while (lines.length < 3) lines.push(""); const caretLine = reducedMotion ? 2 : (visible.match(/\n/g) || []).length; return { line1: lines[0], line2: lines[1], line3: lines[2], caretLine }; } /* ---------- HERO ---------- */ function Hero() { const t = useTheme(); const { narrow, tiny, mobile } = useViewport(); // 25 openers — each: [line1, line2 (dimmed), line3 (final beat with caret)] const openers = useMemo(() => [ ["when the alert", "at 03:14 says", "encrypted."], ["when your CFO emails", "at 06:02 asking", "is this real?"], ["when the SOC tells you", "they've been seeing this", "for six weeks."], ["when the wire instructions", "the controller followed", "weren't yours."], ["when the EDR shrugs and", "the only thing you trust", "is dialtone."], ["when legal asks", "exactly what was", "exfiltrated."], ["when the press calls", "before your", "incident lead does."], ["when the insurer wants", "a written timeline by", "end of business."], ["when the only Slack channel", "still working is the one", "on someone's phone."], ["when production is down,", "the runbook is on prod,", "and prod is locked."], ["when the post-mortem", "you wrote last quarter", "happened again."], ["when the ransom note", "names a deadline,", "and a price."], ["when the threat actor", "knows your tenant ID", "by heart."], ["when the auditor finds it", "before your", "detection stack does."], ["when the dev who", "had the only key", "left in March."], ["when the canary", "you forgot you planted", "finally chirps."], ["when the board calls", "an emergency session", "for tomorrow, 8am."], ["when an engineer says", "this isn't supposed to be", "reachable from the internet."], ["when the IOCs match", "an advisory you", "skimmed last Tuesday."], ["when the only person", "who knows that pipeline", "is on a flight."], ["when 'low severity'", "turns out to be", "domain admin."], ["when the breach disclosure", "clock starts at", "72 hours."], ["when the build server", "starts shipping", "to an address in Tashkent."], ["when your compliance posture", "and your reality", "stop matching."], ["when the customer's lawyer", "knows more about it", "than you do."], ["when the investigation", "is going to take longer", "than the outage."], ["when the threat hunter", "asks if you have", "a minute."], ["when the npm postinstall", "you greenlit on Friday", "wasn't from them."], ], []); const { line1, line2, line3, caretLine } = useTypewriterOpeners(openers); return (
{/* full-bleed looping video background */}
); } function ConsolePanel() { const t = useTheme(); const { mobile, narrow } = useViewport(); const lines = [ { c: t.dim, s: "$ hb-soc --tail engagements" }, { c: t.dim, s: "[connecting to bastion-04 ...] ok" }, { c: t.fg, s: "2026-04-30 14:02:11Z ENG-3041 ransomware contained" }, { c: t.fg, s: "2026-04-30 11:48:55Z ENG-3040 bec / wire in-progress" }, { c: t.fg, s: "2026-04-29 22:17:03Z ENG-3039 cloud-pivot eradicated" }, { c: t.fg, s: "2026-04-29 09:31:42Z ENG-3038 insider remediated" }, { c: t.dim, s: "—" }, { c: t.accent, s: "$ hb-soc --threat-level" }, { c: t.fg, s: "ELEVATED (ransomware affiliates active in legal & MSP)" }, { c: t.dim, s: "$ _" }, ]; return (
live · soc · readonly
{lines.map((l, i) => (
{l.s}
))}
▌
retainer queue
2 slots / Q3
median MTTR
4h 12m
); } /* ---------- SECTIONS ---------- */ function SectionHeader({ no, label, kicker }) { const t = useTheme(); const { mobile } = useViewport(); return (
§{no} {label} {kicker && {kicker}}
); } function Services() { const t = useTheme(); const { narrow, tiny, mobile } = useViewport(); return (

Four things.
Done by people who have done them before.

Every engagement is led by a partner with at least a decade of in-the-room IR experience. No junior-led discovery, no offshore L1, no "platform" you'll never log into. If we can't add value within the first hour, we'll tell you and refund the call fee.

{/* Table-like rows */}
{!narrow && (
idlineavailabilityscopetags
)} {SERVICES.map((s, i) => )}
); } function ServiceRow({ s, idx }) { const t = useTheme(); const { narrow, mobile } = useViewport(); const [hover, setHover] = useState(false); if (narrow) { return (
setHover(true)} onMouseLeave={() => setHover(false)} style={{ padding: mobile ? "20px 16px" : "24px 20px", borderTop: idx === 0 ? `1px solid ${t.rule}` : "none", borderBottom: `1px solid ${t.rule}`, background: hover ? t.panel : "transparent", transition: "background 120ms", cursor: "pointer" }} >
{s.id} {s.sla}
{s.name}
{s.scope}
{s.tags.map(tag => ( {tag} ))}
); } return (
setHover(true)} onMouseLeave={() => setHover(false)} style={{ display: "grid", gridTemplateColumns: "68px minmax(0, 1.2fr) minmax(0, 0.9fr) minmax(0, 2fr) minmax(0, 1.1fr)", padding: "28px 20px", borderBottom: `1px solid ${t.rule}`, gap: 20, alignItems: "start", background: hover ? t.panel : "transparent", transition: "background 120ms", cursor: "pointer" }} > {s.id} {s.name} {s.sla} {s.scope} {s.tags.map(tag => ( {tag} ))}
); } /* ---------- RETAINER STRIP ---------- */ function RetainerStrip() { const t = useTheme(); const { narrow, tiny, mobile } = useViewport(); return (
§02 / RETAINER

The cheapest hour you'll buy this year is the one you buy before you need it.

); } function Pill({ k, v, sub }) { const t = useTheme(); const { tiny, mobile } = useViewport(); return (
{k}
{v}
{sub &&
{sub}
}
); } /* ---------- RESEARCH ---------- */ function Research() { const t = useTheme(); const { narrow, mobile } = useViewport(); const [email, setEmail] = useState(""); const [sub, setSub] = useState(false); return (
{/* LEFT: pitch */}
publishing Q3 2026

The research desk
goes public this summer.

We've been writing internal advisories for our retainer clients since 2016. Later this year we'll start publishing the sanitised versions — actor profiles, IOCs, and after-actions — to anyone who wants to read them.

No marketing newsletter. No gated PDFs. RSS / STIX TAXII friendly. One email when issue 01 ships, then nothing unless something is on fire.

{/* signup */}
{ e.preventDefault(); if (email) setSub(true); }} style={{ marginTop: 36, display: "flex", flexWrap: "wrap", gap: 0, border: `1px solid ${t.rule}`, maxWidth: 520, alignItems: "stretch" }} > $ { setEmail(e.target.value); setSub(false); }} style={{ flex: 1, minWidth: mobile ? 120 : 180, background: "transparent", border: "none", outline: "none", color: t.fg, fontFamily: "inherit", fontSize: mobile ? 13 : 14, padding: "14px 14px" }} />
we will email once. unsubscribe is a one-click mailto. that’s it.
{/* RIGHT: products card stack */}
also from honey badger
{/* DETEKTIX */}

detektix

we catch data leaks before they spread

In the competitive Forex industry, your client data is your most valuable asset. Our innovative approach is refreshingly simple — catch data thieves in the act, not months later.

{[ { h: "Instant Detection", b: "Detects PII leaks instantly, before data spreads." }, { h: "AI-Powered Engagement", b: "Generative AI simulates user behavior and interacts with attackers — gathering threat intel in real time." }, { h: "Stealthy Deception Layer", b: "PhantomID tokens are invisible to legitimate users and undetectable by attackers." }, { h: "Flexible Deployment", b: "Cloud, SaaS, and on-premises data systems." }, ].map((it, i) => (
0{i + 1} {it.h}. {it.b}
))}
detektix.com ↗
{/* WHITESHROUD */}

whiteshroud

open source

Tracker for the ongoing Shai-Hulud npm worm campaign. Live roster of compromised packages, maintainers, and IOCs — pulled from registry telemetry and our own honeypots, updated as the worm spreads.

whiteshroud.io ↗
{/* BADGERINTEL */}

badgerintel feed

curated threat intel

A curated intelligence feed tuned per industry — fintech, forex, gaming, SaaS, e-commerce. IOCs, actor TTPs, and emerging campaigns, filtered to what actually matters for your stack. Delivered as STIX/TAXII, JSON, or weekly briefing.

{ e.preventDefault(); window.dispatchEvent(new CustomEvent("hb-open-contact")); }} style={{ display: "inline-flex", alignItems: "center", gap: 10, padding: "10px 16px", border: `1px solid ${t.fg}`, color: t.fg, textDecoration: "none", fontSize: 11, fontWeight: 700, letterSpacing: "0.08em", textTransform: "uppercase", cursor: "pointer", fontFamily: "inherit" }}> contact for access →
); } function FeaturedAdvisory({ a }) { const t = useTheme(); return (
{a.id} · {a.date} · {a.sev} · actor: {a.actor}

{a.title}

Initial access via unauthenticated template-injection. Operators stage Cobalt Strike beacons within 22 minutes of foothold and pivot to ESXi within 4 hours. We've observed three confirmed engagements this week; two contained pre-encryption.

{a.sectors.map(s => {s})}
read full advisory ↗ {a.reads} reads
); } function AdvisoryRow({ a }) { const t = useTheme(); const [hover, setHover] = useState(false); return ( setHover(true)} onMouseLeave={() => setHover(false)} style={{ display: "block", padding: "20px 28px", borderBottom: `1px solid ${t.rule}`, textDecoration: "none", color: "inherit", background: hover ? t.panel : "transparent", transition: "background 120ms" }}>
{a.id} {a.date}
{a.title}
{a.sev} · {a.actor} · {a.sectors.join(" · ")}
); } /* ---------- FOOTER ---------- */ function Footer() { const t = useTheme(); const { narrow, tiny, mobile } = useViewport(); const cols = [ { h: "services", items: ["incident response", "managed detection", "threat hunting", "retainer & tabletop", "expert witness"] }, { h: "research", items: ["coming soon · Q3 2026", "join the notify list", "responsible disclosure"] }, { h: "company", items: ["about", "team", "detektix ↗", "contact"] }, { h: "contact", items: ["IR hotline · 24/7", "+1 929 458 0453", "secure contact form"] }, ]; return (
honeybadger/sec

Honey Badger Security Ltd. is a privately-held incident response firm founded in 2016. We are not VC-funded, we are not for sale, and we do not subcontract live engagements.

warrant canary · {new Date().toISOString().slice(0,10)}
No national-security letters or gag orders received as of this date.
{cols.map(c => (
{c.h}
    {c.items.map(i => (
  • {i}
    • ))}
))}
© 2016–2026 honey badger security ltd. privacy terms security.txt ↗ status ↗
); } /* ---------- TWEAKS ---------- */ const DEFAULTS = /*EDITMODE-BEGIN*/{ "theme": "amber" }/*EDITMODE-END*/; function ContactField({ label, dim, children }) { return ( ); } function ContactModal() { const t = useTheme(); const { tiny, mobile } = useViewport(); const [open, setOpen] = useState(false); const [form, setForm] = useState({ name: "", company: "", email: "", urgency: "retainer", message: "" }); const [status, setStatus] = useState("idle"); // idle | sending | sent | error const [errorMsg, setErrorMsg] = useState(""); useEffect(() => { const on = () => { setOpen(true); setStatus("idle"); setErrorMsg(""); }; window.addEventListener("hb-open-contact", on); const onKey = (e) => { if (e.key === "Escape") setOpen(false); }; window.addEventListener("keydown", onKey); return () => { window.removeEventListener("hb-open-contact", on); window.removeEventListener("keydown", onKey); }; }, []); // body-scroll lock while modal is open useEffect(() => { if (!open) return; const prev = document.body.style.overflow; document.body.style.overflow = "hidden"; return () => { document.body.style.overflow = prev; }; }, [open]); if (!open) return null; const submit = async (e) => { e.preventDefault(); if (status === "sending") return; setStatus("sending"); setErrorMsg(""); try { const r = await fetch("/api/contact", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(form), }); if (!r.ok) { const data = await r.json().catch(() => ({})); throw new Error(data.error || `request failed (${r.status})`); } setStatus("sent"); } catch (err) { setStatus("error"); setErrorMsg(err.message || "could not send. please try again or call the hotline."); } }; const inputStyle = { background: "transparent", border: `1px solid ${t.rule}`, color: t.fg, fontFamily: "inherit", fontSize: 16, padding: "12px 14px", outline: "none", width: "100%", boxSizing: "border-box" }; const sending = status === "sending"; return (
setOpen(false)} role="dialog" aria-modal="true" aria-label="Contact form" style={{ position: "fixed", inset: 0, background: "rgba(0,0,0,0.78)", backdropFilter: "blur(4px)", WebkitBackdropFilter: "blur(4px)", zIndex: 100, display: "flex", alignItems: mobile ? "stretch" : "center", justifyContent: "center", padding: mobile ? 0 : 20 }}>
e.stopPropagation()} style={{ background: t.bg, border: mobile ? "none" : `1px solid ${t.rule}`, color: t.fg, width: "100%", maxWidth: 560, maxHeight: mobile ? "100vh" : "90vh", overflow: "auto", fontFamily: "inherit" }}>
§ contact / honeybadger.sec

get in touch.

For active incidents, call +1 929 458 0453. Everything else — fill this in and we’ll reply within one business day.

{status === "sent" ? (
message received. we’ll reply within one business day. for active incidents, call +1 929 458 0453.
) : (
setForm({ ...form, name: e.target.value })} style={inputStyle} /> setForm({ ...form, company: e.target.value })} style={inputStyle} />
setForm({ ...form, email: e.target.value })} style={inputStyle} />