// Posts data — fictional research-blog content. No copyrighted UI replicated.
const POSTS = [
  // 2026
  { id: "p26-04", date: "2026-04-22", year: 2026, sev: "high", tag: "ai-security",
    title: "Indirect prompt injection via PDF metadata in RAG pipelines",
    summary: "Hidden XMP fields inside ingested PDFs steered a customer-support agent into exfiltrating system prompts. Reproducible PoC against three popular open-source stacks.",
    read: "18 min", featured: false, slug: "rag-pdf-metadata" },
  { id: "p26-03", date: "2026-04-04", year: 2026, sev: "critical", tag: "ai-security",
    title: "When the dealership chatbot sold a Tahoe for one dollar — anatomy of a $1 LLM",
    summary: "A walkthrough of the December 2023 Chevrolet of Watsonville incident, the Bing/Sydney prompt-leak family, and a taxonomy of jailbreak shapes that still work in 2026 against unguarded retail agents.",
    read: "26 min", featured: true, slug: "tahoe-for-a-dollar",
    tags: ["llm", "prompt-injection", "case-study"] },
  { id: "p26-02", date: "2026-03-19", year: 2026, sev: "medium", tag: "web",
    title: "HTTP/3 stream multiplexing as a side channel for cache deception",
    summary: "Cloudflare and Akamai edges disagree on whether QUIC stream IDs influence the cache key. Five hosts, five outcomes.",
    read: "12 min", featured: false, slug: "h3-cache-deception" },
  { id: "p26-01", date: "2026-02-11", year: 2026, sev: "high", tag: "active-directory",
    title: "Reviving sAMAccountName confusion: a 2026 follow-up to CVE-2021-42278",
    summary: "What changed in patched DCs, what didn't, and a fresh primitive that still grants Domain Admin in mixed-mode forests.",
    read: "22 min", featured: false, slug: "sam-2026" },

  // 2025
  { id: "p25-08", date: "2025-12-08", year: 2025, sev: "critical", tag: "vuln-research",
    title: "A use-after-free in libwebrtc's RTPSenderEgress reachable from unprivileged JS",
    summary: "Root-cause analysis, exploit primitives, and a sketch of the v8 sandbox bypass it implies. Reported, fixed, disclosed.",
    read: "31 min", featured: false, slug: "libwebrtc-uaf" },
  { id: "p25-07", date: "2025-11-02", year: 2025, sev: "medium", tag: "network",
    title: "Reading the room: passive OS fingerprinting from QUIC initial packets",
    summary: "p0f for a post-TCP world. Padding, version negotiation, ALPN ordering — small leaks add up.",
    read: "14 min", featured: false, slug: "quic-p0f" },
  { id: "p25-06", date: "2025-09-21", year: 2025, sev: "low", tag: "tooling",
    title: "Building a pentest journal in plaintext: a workflow that survives clients",
    summary: "Why nothing beats append-only Markdown + a sane folder layout. Includes the template I've used for 60+ engagements.",
    read: "9 min", featured: false, slug: "pentest-journal" },
  { id: "p25-05", date: "2025-07-30", year: 2025, sev: "high", tag: "web",
    title: "Server-side request smuggling through misaligned chunk-extension parsing",
    summary: "When the CDN trims chunk extensions and the origin doesn't, you get a clean desync without any HTTP/2 weirdness.",
    read: "17 min", featured: false, slug: "chunk-ext-smuggling" },
  { id: "p25-04", date: "2025-06-14", year: 2025, sev: "medium", tag: "active-directory",
    title: "ADCS ESC15: a new template misconfiguration in the wild",
    summary: "Found across three engagements in Q2. Detection queries, exploitation steps, and a hardening checklist for blue teams.",
    read: "20 min", featured: false, slug: "adcs-esc15" },
  { id: "p25-03", date: "2025-04-25", year: 2025, sev: "info", tag: "notes",
    title: "Field notes: 90 days inside a SOC, written for the people on the other side",
    summary: "What red teams should know about how their work actually lands in a defender's queue.",
    read: "11 min", featured: false, slug: "soc-fieldnotes" },
  { id: "p25-02", date: "2025-03-03", year: 2025, sev: "high", tag: "vuln-research",
    title: "Fuzzing eBPF verifier paths that aren't in the test corpus",
    summary: "A weekend's worth of harness work, two reachable WARN_ON()s, and one quiet kernel CVE.",
    read: "24 min", featured: false, slug: "ebpf-verifier" },
  { id: "p25-01", date: "2025-01-19", year: 2025, sev: "low", tag: "tooling",
    title: "A small wrapper around Nuclei for engagement-scoped templates",
    summary: "Five hundred lines of Go, six months of saved hours.",
    read: "7 min", featured: false, slug: "nuclei-wrap" },

  // 2024
  { id: "p24-05", date: "2024-11-17", year: 2024, sev: "critical", tag: "web",
    title: "Cross-site WebSocket hijacking is back, this time over service workers",
    summary: "A pattern I've now seen at three companies. Origin checks survive, the assumption underneath them does not.",
    read: "16 min", featured: false, slug: "cswsh-sw" },
  { id: "p24-04", date: "2024-09-03", year: 2024, sev: "medium", tag: "network",
    title: "Mapping a /16 in 40 seconds with a single masscan invocation, responsibly",
    summary: "Speed without setting off every IDS in the building. Rate, source-port distribution, ARP locality.",
    read: "10 min", featured: false, slug: "masscan-16" },
  { id: "p24-03", date: "2024-06-22", year: 2024, sev: "high", tag: "active-directory",
    title: "Kerberoasting AS-REP-roastable accounts the patient way",
    summary: "When you have time and a quiet network, low-and-slow beats every loud tool in the kit.",
    read: "13 min", featured: false, slug: "kerberoast-patient" },
  { id: "p24-02", date: "2024-04-08", year: 2024, sev: "info", tag: "notes",
    title: "Why I stopped writing reports in Word",
    summary: "Markdown → Pandoc → Typst. A pipeline that survives the PM's track-changes.",
    read: "6 min", featured: false, slug: "no-more-word" },
  { id: "p24-01", date: "2024-02-12", year: 2024, sev: "high", tag: "vuln-research",
    title: "A heap overflow in an unloved JPEG decoder, reachable from MMS",
    summary: "Small bug, large blast radius. Disclosure was uneventful; the vendor had a process. Most don't.",
    read: "19 min", featured: false, slug: "jpeg-mms" },
];

const TAGS = [
  { id: "all",              label: "all" },
  { id: "ai-security",      label: "ai-security" },
  { id: "web",              label: "web" },
  { id: "active-directory", label: "active-directory" },
  { id: "vuln-research",    label: "vuln-research" },
  { id: "network",          label: "network" },
  { id: "tooling",          label: "tooling" },
  { id: "notes",            label: "notes" },
];

const SEVERITIES = ["critical","high","medium","low","info"];

const ACTIVITY = [
  { when: "2d", what: "Published " , em: "rag-pdf-metadata" },
  { when: "9d", what: "Updated PoC for ", em: "tahoe-for-a-dollar" },
  { when: "3w", what: "Reported CVE-2026-3331 to MITRE" },
  { when: "5w", what: "Talk: PrintNightmare 5y on, " , em: "BSidesTLV"},
];

Object.assign(window, { POSTS, TAGS, SEVERITIES, ACTIVITY });