Nothing here is a secret. Every entry is built from documents that were already public before we touched them: court filings and dockets, SEC and agency orders, sanctions, congressional testimony, breach disclosures, and the posts people published themselves under #SecurityCharlatans on X. The receipts are public. This site is an index over them — the filing cabinet, not the source.
Assembled by machine, held to a human standard. These dossiers are put together with the best research methods available today — automated collection, retrieval, and analysis, the kind of robot work that can read a thousand filings in the time it takes to threaten one lawyer. That is how the record gets built at speed. It is not how it gets trusted. Every load-bearing claim is traced back to a source that actually resolves, cross-checked against the primary document, and cited inline so you can click through and read it yourself. Machine speed; a standard that predates the machine.
It isn't defamation. It's the record. Truth is an absolute defense, and everything here is either true-and-sourced or it isn't here. We hold one line above all others, and it isn't caution — it's accuracy: a proven fact is stated as a fact, and an allegation is stated as an allegation, attributed to whoever made it, with the subject's own denial standing right beside it. "The SEC charged X and X settled" is a fact. "X committed fraud," when a case was dismissed or settled without admission, is not — so we don't say it. That distinction isn't us going soft. It is the truth, told precisely.
So every case file here is built two-sided on purpose: the case, the defense, and then it's left with you. We don't hand down a verdict. We lay out what the public record says, in order, sourced, and let the facts do the damning. The burden of proof is on us, not on the subject. If a claim can't survive a defamation challenge, it never makes the page.
Correcting the record. This is a living archive, not the last word, and machines get things wrong. If you have first-hand knowledge that corrects an entry, you don't need our permission and you don't need an account here: post your account anywhere on the internet — your blog, a thread, a court filing, a screenshot — and tag it #SecurityCharlatans (or #0xdrama for the scene-drama files) with a link. We follow both tags. Bring receipts, and the receipt wins — against us included.
Where this comes from. Two ancestors. For fifteen years Brian Martin (Jericho) ran the attrition.org Charlatan List, documenting industry fraudsters with adversarial sourcing; he took more than forty legal threats and stopped because he got tired, and nobody replaced him. And Philip Kaplan's Fucked Company (2000–2007) kept the dot-com deadpool — the running tally of who was about to fold and why. One tracked the liars; the other tracked the wreckage. This is the successor to both, pointed at the security industry, and run by robots that don't get tired.