How Should a Cybersecurity Specialist in Spain Combine CTFs, CVEs, and Confidential Audits?

Which security projects are safe to publish?

Publish research, write-ups, tools, and disclosures only when they are already public, authorised, and stripped of secrets or client identifiers.

A CTF write-up can link to the public challenge or your authorised explanation. A vulnerability entry should point to the official public record or vendor-approved disclosure, not to private correspondence or unreleased exploit details.

An audit can appear as an anonymised case when the engagement permits it. Explain the class of system, your scope, and the remediation work at a safe level without naming targets, endpoints, credentials, or findings that remain sensitive.

What is the fast way to structure the security portfolio with IndieShow?

The fast way is to use IndieShow cards for public research, tools, approved assessments, and current projects, with each card placed in the section that reflects its status.

Give each card a narrow tag such as security research, CTF, tooling, or assessment. The description should separate team output from your own testing, writing, engineering, or remediation contribution.

Use one controlled destination per project: an official advisory, repository, public write-up, conference material, or approved case study. The stable profile link can then sit on your CV without exposing private working folders.

Build your IndieShow pageClaim your handle, organise the evidence in the editor, then review the $15 one-year and $30 lifetime publishing options in the dashboard.

How should CTFs and CVEs differ on the page?

Present CTFs as practice or competition evidence and CVEs as coordinated public research, never as interchangeable proof of production security work.

For a team CTF, name the category and your contribution rather than claiming the team placement as a solo result. Keep only write-ups that demonstrate reasoning relevant to the work you want.

For vulnerability research, record the public identifier or approved advisory and the role you played. Do not imply that submitting, discovering, and remediating were all your work unless that is accurate.

How do you anonymise a confidential security assessment?

Describe the permitted system category, assessment boundary, your actions, and the remediation outcome without leaving clues that identify the client or attack surface.

Avoid screenshots of tooling against real hosts and do not recreate sensitive findings in a public demo. A sanitized lab can be a separate project, clearly labelled as a lab rather than client evidence.

If the contract does not permit a public case, omit it. Confidentiality is part of security judgement, and a shorter responsible portfolio is stronger than a larger one built from questionable disclosure.

Useful IndieShow guides: presenting NDA-bound consulting work · organising public tools and repositories

How does IndieShow support a responsible security portfolio?

IndieShow supports it by keeping short, status-labelled project summaries and controlled outbound links on one page, while leaving sensitive artifacts in their authorised systems.

Move old tools or completed research to Archived when they no longer represent maintained work, and remove destinations that become unsafe or unavailable. The Womp womp section can label unsuccessful experiments honestly without overselling them.

IndieShow is the public index, not a vault for evidence: it helps recruiters or clients understand what exists and where approved proof can be inspected.