From 2af29c01229d6c871c30c4f9d6c472a286e23112 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Tue, 8 Sep 2026 00:56:46 +0000 Subject: [PATCH] Add Series Three: Security Professionals, 50 cards at /security-professionals MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The third collection, for the defensive side of the field: cryptographers, firewall and tool authors, incident responders, appsec people and the security chiefs who had to answer for the breach. 50 hand-curated entries, every one carrying at least two public sources for the claims in its scouting report. Nobody appears in more than one series, which is enforced by curation rather than code — Series Two already holds Mudge, Kaminsky, Moussouris, Wysopal, Rutkowska, HD Moore and the rest, so none of them are here. Series Three uses a different stat block than Series Two: `notoriety` is the wrong axis for people whose careers were spent keeping their names out of the news, so the four bars are technical / defense / research / influence. Mechanics: - `src/data/roster.ts` holds the card vocabulary both hand-curated series share (Rarity, Status, Source, the fields RosterCard reads, and the label maps). `hacking.ts` now extends it instead of redeclaring it. - `RosterCard` takes `entry` + `basePath` so it renders any series. An entry with no rendered `front` no longer links anywhere — card pages only exist once art does, so an un-illustrated set stops pointing at 404s. - Series Three has no art pipeline yet, so it ships as a roster page only and contributes just its index to the sitemap. Nav, home-page teaser, sitemap, README and the contribute spec are updated. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014htrUgbnoKQt9iT4G7hUpy --- README.md | 56 +- src/app/contribute/page.tsx | 13 +- src/app/hacking-legends/page.tsx | 2 +- src/app/page.tsx | 24 + .../security-professionals/page.module.css | 248 ++++ src/app/security-professionals/page.tsx | 195 +++ src/app/sitemap.ts | 24 +- src/components/RosterCard.tsx | 72 +- src/data/hacking.ts | 52 +- src/data/roster.ts | 59 + src/data/security.ts | 1259 +++++++++++++++++ src/data/site.ts | 1 + 12 files changed, 1918 insertions(+), 87 deletions(-) create mode 100644 src/app/security-professionals/page.module.css create mode 100644 src/app/security-professionals/page.tsx create mode 100644 src/data/roster.ts create mode 100644 src/data/security.ts diff --git a/README.md b/README.md index daa1a73..01053de 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ signups into the `waitlist` table. ## Card production -Two decks, one per series. Approved portrait art lives under +Three decks, one per series. Approved portrait art lives under `assets/portraits//` — see [assets/portraits/README.md](assets/portraits/README.md). **Series One — Open Source Legends** (`data/roster.locked.json`, complete): @@ -78,35 +78,55 @@ Chromium — set `CHROME_PATH` if it is not on the usual paths. `dist/hacking/` is gitignored, so the full-resolution faces are local only. Archive them before wiping the directory if you want print masters. +**Series Three — Security Professionals** (`src/data/security.ts`, roster only): + +50 hand-curated cards for the defensive side of the field. Copy and sources are +written; no art pipeline exists yet, so the set renders as a data-only roster at +`/security-professionals` and its cards have no `front`/`back` and no card pages. +When art starts, copy `scripts/hacking-legends.mjs` — the data module already +carries every field that pipeline reads. + +Nobody appears in more than one series; `src/data/roster.ts` holds the shared card +vocabulary that Series Two and Three both render through. + ## Project layout ``` src/ app/ - page.tsx # landing page - cards/ # the full set gallery - collect/ # physical packs · NFT mint · print-your-own - contribute/ # how to nominate / add a legend - globals.css # design tokens + utilities - layout.tsx # header/footer shell + metadata + page.tsx # landing page + cards/ # Series One gallery + card pages + hacking-legends/ # Series Two roster + card pages + security-professionals/ # Series Three roster + collect/ # physical packs · NFT mint · print-your-own + contribute/ # how to nominate / add a legend + globals.css # design tokens + utilities + layout.tsx # header/footer shell + metadata components/ - LegendCard.tsx # the trading-card component (matches the print design) - Header / Footer / WaitlistForm + CardFlip.tsx # Series One flip card + RosterCard.tsx # shared roster tile for Series Two and Three + CardDetail.tsx # the card page body + Header / Footer / WaitlistForm / AdUnit data/ - legends.ts # the card data — one typed record per legend - site.ts # site config (name, links, license) + roster.ts # shared card vocabulary (rarity, status, sources) + cards.ts # Series One — generated from the locked roster + hacking.ts # Series Two — hand-curated + security.ts # Series Three — hand-curated + site.ts # site config (name, links, license) public/ - crest.svg # the Open Source Legends crest - cards/ # optional portrait art: /cards/.jpg -docs/ # print proofs / design references + crest.svg # the Open Source Legends crest + cards/ # rendered card faces, one directory per series +docs/ # print proofs / design references ``` ## Add a legend -Append a typed record to `src/data/legends.ts` (see the spec on the -`/contribute` page) and, optionally, drop portrait art at -`public/cards/.jpg`. Cards with no portrait render a monogram fallback. -Then open a pull request. +Append a typed record to the data module for the series — `src/data/hacking.ts` +for Series Two, `src/data/security.ts` for Series Three (see the spec on the +`/contribute` page). Every entry needs at least one public source for the claims +in its scouting report, and no name may appear in more than one series. Art is +generated later by the publish step, so leave `front`/`back` off. Then open a +pull request. ## License diff --git a/src/app/contribute/page.tsx b/src/app/contribute/page.tsx index e349498..b97e9cb 100644 --- a/src/app/contribute/page.tsx +++ b/src/app/contribute/page.tsx @@ -71,10 +71,15 @@ export default function ContributePage() { The card spec

One legend, one record

- Series Two is the set currently taking nominations. Its roster is - hand-curated in src/data/hacking.ts, and that - file is the source of truth — the pipeline reads it directly, so there is no - second copy to keep in sync. + Series Two and Series Three are both taking nominations. Each roster is + hand-curated in one file — src/data/hacking.ts{' '} + for Hacking Legends, src/data/security.ts for + Security Professionals — and that file is the source of truth: the pipeline + reads it directly, so there is no second copy to keep in sync. Series Three + swaps the social and{' '} + notoriety bars for{' '} + defense and{' '} + research, and no name may appear in two sets. 

diff --git a/src/app/hacking-legends/page.tsx b/src/app/hacking-legends/page.tsx
index 9bef88b..976e254 100644
--- a/src/app/hacking-legends/page.tsx
+++ b/src/app/hacking-legends/page.tsx
@@ -139,7 +139,7 @@ export default function HackingLegendsPage() {
 
           

             {hackers.map((h) => (
-              
+              
             ))}
           

         
diff --git a/src/app/page.tsx b/src/app/page.tsx
index 7a92129..d88b229 100644
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -3,6 +3,7 @@ import CardFlip from '@/components/CardFlip';
 import AdUnit from '@/components/AdUnit';
 import { cards, featured } from '@/data/cards';
 import { hackers, illustratedCount, lockedCount } from '@/data/hacking';
+import { pros, totalPlanned as proTotal } from '@/data/security';
 import { site } from '@/data/site';
 import styles from './page.module.css';
 
@@ -103,6 +104,29 @@ export default function Home() {
         
       
 
+      {/* Series Three teaser */}
+      

+        

+          

+            

+              Series Three · In progress
+              
Security Professionals

+              

+                And the half that had to clean up: cryptographers, firewall builders,
+                incident responders, tool authors and the security chiefs who answered for
+                the breach. {pros.length} of {proTotal} names drafted, art not started, and
+                the cuts are still up for argument.
+              

+            

+            

+              
+                See the roster →
+              
+            

+          

+        

+      

+
       {/* In-content ad */}
       

         

diff --git a/src/app/security-professionals/page.module.css b/src/app/security-professionals/page.module.css
new file mode 100644
index 0000000..7a6dbc4
--- /dev/null
+++ b/src/app/security-professionals/page.module.css
@@ -0,0 +1,248 @@
+/* Hero */
+.hero {
+  padding: 8rem 0 5rem;
+  background:
+    radial-gradient(70rem 34rem at 20% -20%, rgba(37, 194, 110, 0.10), transparent 65%),
+    transparent;
+}
+
+.kicker {
+  display: inline-flex;
+  align-items: center;
+  gap: 1rem;
+  margin-bottom: 2rem;
+}
+
+.wip {
+  font-size: 1.05rem;
+  letter-spacing: 0.16em;
+  color: var(--rare);
+  border: 1px solid color-mix(in srgb, var(--rare) 45%, var(--border));
+  border-radius: 999px;
+  padding: 0.3rem 0.9rem;
+}
+
+.title {
+  font-size: clamp(3.6rem, 6.5vw, 7rem);
+  font-weight: 800;
+  letter-spacing: -0.035em;
+  margin-bottom: 2rem;
+}
+
+.lede {
+  font-size: 1.8rem;
+  color: var(--text-muted);
+  max-width: 68rem;
+  margin-bottom: 1.8rem;
+}
+
+.warning {
+  font-size: 1.4rem;
+  color: var(--text-dim);
+  max-width: 68rem;
+  border-left: 2px solid var(--crest);
+  padding-left: 1.6rem;
+  margin-bottom: 3rem;
+}
+
+.actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 1.2rem;
+}
+
+/* Progress strip */
+.progress {
+  border-top: 1px solid var(--border-soft);
+  border-bottom: 1px solid var(--border-soft);
+  background: var(--bg-deep);
+}
+
+.progressInner {
+  display: grid;
+  grid-template-columns: 1.3fr 1fr;
+  gap: 4rem;
+  padding-top: 4rem;
+  padding-bottom: 4rem;
+}
+
+.bars {
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+  align-self: center;
+}
+
+.barRow {
+  display: grid;
+  grid-template-columns: 16rem 1fr 6rem;
+  align-items: center;
+  gap: 1.6rem;
+}
+
+.barLabel {
+  font-size: 1.35rem;
+  color: var(--text-muted);
+}
+
+.barTrack {
+  height: 0.6rem;
+  border-radius: 999px;
+  background: var(--bg-elev-2);
+  overflow: hidden;
+}
+
+.barFill {
+  display: block;
+  height: 100%;
+  border-radius: 999px;
+  background: linear-gradient(90deg, var(--crest-deep), var(--crest));
+}
+
+.barVal {
+  font-size: 1.3rem;
+  font-weight: 700;
+  color: var(--crest);
+  text-align: right;
+}
+
+.aside {
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  padding: 2.6rem;
+}
+
+.asideHead {
+  font-size: 1.7rem;
+  font-weight: 800;
+  margin-bottom: 1.4rem;
+}
+
+.steps {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  padding-left: 2rem;
+  font-size: 1.4rem;
+  color: var(--text-muted);
+}
+
+/* Sections */
+.head {
+  max-width: 70rem;
+  margin-bottom: 3.6rem;
+}
+
+.h2 {
+  font-size: clamp(2.8rem, 3.5vw, 4rem);
+  font-weight: 800;
+  margin-top: 1rem;
+}
+
+.sub {
+  font-size: 1.5rem;
+  color: var(--text-muted);
+  margin-top: 1.2rem;
+}
+
+.grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(30rem, 1fr));
+  gap: 2.2rem;
+  align-items: start;
+}
+
+/* Criteria */
+.criteria {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 2.2rem;
+}
+
+.criterion {
+  background: var(--bg-elev);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  padding: 2.8rem;
+}
+
+.criterionTag {
+  display: inline-block;
+  font-size: 1.05rem;
+  font-weight: 700;
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--crest);
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  padding: 0.4rem 1rem;
+  margin-bottom: 1.8rem;
+}
+
+.criterion h3 {
+  font-size: 2rem;
+  font-weight: 800;
+  margin-bottom: 1rem;
+}
+
+.criterion p {
+  font-size: 1.45rem;
+  color: var(--text-muted);
+}
+
+/* Band */
+.band {
+  padding: 4rem 0 8rem;
+}
+
+.bandInner {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 3rem;
+  background:
+    radial-gradient(80% 140% at 100% 0%, rgba(37, 194, 110, 0.10), transparent 60%),
+    var(--bg-elev);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  padding: 4rem;
+}
+
+.bandInner p {
+  color: var(--text-muted);
+  font-size: 1.5rem;
+  max-width: 56rem;
+  margin-top: 1rem;
+}
+
+.bandActions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 1.2rem;
+}
+
+@media (max-width: 980px) {
+  .progressInner {
+    grid-template-columns: 1fr;
+    gap: 3rem;
+  }
+  .criteria {
+    grid-template-columns: 1fr;
+  }
+}
+
+@media (max-width: 680px) {
+  .barRow {
+    grid-template-columns: 1fr 5rem;
+    row-gap: 0.8rem;
+  }
+  .barLabel {
+    grid-column: 1 / -1;
+  }
+  .bandInner {
+    flex-direction: column;
+    align-items: flex-start;
+    padding: 2.8rem;
+  }
+}
diff --git a/src/app/security-professionals/page.tsx b/src/app/security-professionals/page.tsx
new file mode 100644
index 0000000..d40f1d8
--- /dev/null
+++ b/src/app/security-professionals/page.tsx
@@ -0,0 +1,195 @@
+import type { Metadata } from 'next';
+import Link from 'next/link';
+import RosterCard from '@/components/RosterCard';
+import AdUnit from '@/components/AdUnit';
+import { site } from '@/data/site';
+import {
+  pros,
+  totalPlanned,
+  lockedCount,
+  draftedCount,
+  illustratedCount,
+} from '@/data/security';
+import styles from './page.module.css';
+
+export const metadata: Metadata = {
+  title: 'Security Professionals',
+  description:
+    'Series Three, in progress: 50 trading cards for the cryptographers, defenders, tool authors and security leaders who held the line. Roster open for nominations.',
+  openGraph: {
+    title: `Security Professionals · ${site.name}`,
+    description:
+      'Series Three, in progress: 50 trading cards for the cryptographers, defenders, tool authors and security leaders who held the line.',
+    url: `${site.url}/security-professionals`,
+    type: 'website',
+  },
+  alternates: { canonical: '/security-professionals' },
+};
+
+const CRITERIA = [
+  {
+    tag: 'Documented',
+    head: 'It has to be on the record',
+    body: 'Every card cites the paper, the book, the source tree or the report behind the claim. If we cannot link it, it does not go on the card.',
+  },
+  {
+    tag: 'Load-bearing',
+    head: 'Somebody still depends on it',
+    body: 'A protocol, a tool, a process or a body of research that defenders are using today. A long job title is not a qualification for this set.',
+  },
+  {
+    tag: 'Distinct',
+    head: 'Nobody appears twice',
+    body: 'Series Two documents the people who broke things. This one documents the people whose job was to hold. A name in Hacking Legends cannot also be here.',
+  },
+];
+
+export default function SecurityProfessionalsPage() {
+  const pct = Math.round((draftedCount / totalPlanned) * 100);
+
+  return (
+    <>
+      {/* Hero */}
+      

+        

+          
+            Series Three In progress
+          
+          

+            Security Professionals
+          

+          

+            The third set, and the largest. Cryptographers, firewall builders, incident
+            responders, tool authors and the security chiefs who had to answer for the
+            breach — {totalPlanned} cards for the people who spent their careers holding the
+            line rather than crossing it.
+          

+          

+            This set is being built in public. Copy is drafted, stats are in flux, and{' '}
+            {illustratedCount === 0
+              ? 'not a single portrait has been illustrated yet'
+              : `${illustratedCount} of ${totalPlanned} cards are illustrated so far`}
+            . What you see below is the working roster.
+          

+          

+            
+              Nominate a professional
+            
+            See the roster →
+          

+        

+      

+
+      {/* Progress */}
+      

+        

+          

+            

+              Roster drafted
+              
+                
+              
+              {draftedCount}/{totalPlanned}
+            

+            

+              Cards locked
+              
+                
+              
+              {lockedCount}/{totalPlanned}
+            

+            

+              Artwork rendered
+              
+                
+              
+              {illustratedCount}/{totalPlanned}
+            

+          

+
+          
+        

+      

+
+      {/* Roster */}
+      

+        

+          

+            The working roster
+            
{pros.length} names, ordered by set number

+            

+              Open the scouting report for the sources behind each claim. Card pages go up
+              once the art does. Nothing here is final until the set is frozen — argue with
+              any of it on GitHub.
+            

+          

+
+          

+            {pros.map((p) => (
+              
+            ))}
+          

+        

+      

+
+      

+        

+          
+        

+      

+
+      {/* Criteria */}
+      

+        

+          

+            Selection
+            
What earns a card

+          

+          

+            {CRITERIA.map((c) => (
+              

+                {c.tag}
+                
{c.head}

+                
{c.body}

+              

+            ))}
+          

+        

+      

+
+      {/* Band */}
+      

+        

+          

+            
Who are we missing?

+            

+              Fifty slots is not many for a field this old, and the cuts were painful.
+              Nominate a defender, challenge a stat line, or rewrite a scouting report —
+              every card starts as a pull request.
+            

+          

+          

+            
+              Open a nomination
+            
+            See Series Two
+          

+        

+      

+    
+  );
+}
diff --git a/src/app/sitemap.ts b/src/app/sitemap.ts
index b91dfcd..f3010fb 100644
--- a/src/app/sitemap.ts
+++ b/src/app/sitemap.ts
@@ -1,11 +1,21 @@
 import type { MetadataRoute } from 'next';
 import { cards } from '@/data/cards';
 import { hackers } from '@/data/hacking';
+import { pros } from '@/data/security';
 import { site } from '@/data/site';
 
-// Small enough to stay a single sitemap — 4 static pages plus one per card.
+// Small enough to stay a single sitemap — the static pages plus one per illustrated card.
+// A card page only exists once its art is rendered, so un-illustrated sets contribute
+// their index page and nothing else.
 export default function sitemap(): MetadataRoute.Sitemap {
-  const staticPages = ['', '/cards', '/hacking-legends', '/collect', '/contribute'].map(
+  const staticPages = [
+    '',
+    '/cards',
+    '/hacking-legends',
+    '/security-professionals',
+    '/collect',
+    '/contribute',
+  ].map(
     (path) => ({
       url: `${site.url}${path}`,
       changeFrequency: 'weekly' as const,
@@ -27,5 +37,13 @@ export default function sitemap(): MetadataRoute.Sitemap {
       priority: 0.6,
     }));
 
-  return [...staticPages, ...cardPages, ...hackerPages];
+  const proPages = pros
+    .filter((p) => p.front)
+    .map((p) => ({
+      url: `${site.url}/security-professionals/${p.slug}`,
+      changeFrequency: 'monthly' as const,
+      priority: 0.6,
+    }));
+
+  return [...staticPages, ...cardPages, ...hackerPages, ...proPages];
 }
diff --git a/src/components/RosterCard.tsx b/src/components/RosterCard.tsx
index 50928cd..6fbeb21 100644
--- a/src/components/RosterCard.tsx
+++ b/src/components/RosterCard.tsx
@@ -1,8 +1,9 @@
 'use client';
 import { useState } from 'react';
+import type { ReactNode } from 'react';
 import Link from 'next/link';
-import type { Hacker } from '@/data/hacking';
-import { rarityLabel, statusLabel } from '@/data/hacking';
+import type { RosterEntry } from '@/data/roster';
+import { rarityLabel, statusLabel } from '@/data/roster';
 import styles from './RosterCard.module.css';
 
 function host(url: string) {
@@ -13,13 +14,46 @@ function host(url: string) {
   }
 }
 
-// Series Two is illustrated card by card. Anyone with a rendered front shows it;
-// the rest fall back to a data-only proof so the whole roster stays reviewable.
+function ArtWrap({
+  href,
+  className,
+  label,
+  children,
+}: {
+  href?: string;
+  className: string;
+  label: string;
+  children: ReactNode;
+}) {
+  if (!href) {
+    return {children};
+  }
+  return (
+    
+      {children}
+    
+  );
+}
+
+// Shared by every hand-curated series. A set is illustrated card by card: anyone
+// with a rendered front shows it, the rest fall back to a data-only proof so the
+// whole roster stays reviewable before a single portrait is commissioned.
+// Card pages only exist once art does, so an un-illustrated entry renders its own
+// name as plain text rather than linking somewhere that would 404.
 // The root is an 
, not a 

 
-      
+      
         {hacker.front ? (
           
             {/* eslint-disable-next-line @next/next/no-img-element */}
@@ -44,12 +82,16 @@ export default function RosterCard({ hacker }: { hacker: Hacker }) {
             art pending
           
         )}
-      
+      
 
       

-        
-          {hacker.name}
-        
+        {hasPage ? (
+          
+            {hacker.name}
+          
+        ) : (
+          {hacker.name}
+        )}
         {hacker.handle && “{hacker.handle}”}
         {hacker.title}
         {hacker.knownFor}
@@ -99,9 +141,11 @@ export default function RosterCard({ hacker }: { hacker: Hacker }) {
         
-        
-          Card page →
-        
+        {hasPage && (
+          
+            Card page →
+          
+        )}
       

     
   );
diff --git a/src/data/hacking.ts b/src/data/hacking.ts
index 8f7b512..3a1d1e9 100644
--- a/src/data/hacking.ts
+++ b/src/data/hacking.ts
@@ -5,22 +5,13 @@
 // keep scouting reports factual and neutral — this set documents history, it does not
 // endorse crimes. No invented quotes: the `note` field is editorial voice, not attribution.
 
-export type Rarity = 'iconic' | 'legendary' | 'epic' | 'rare';
+import type { RosterEntry, Rarity, Status, Source } from './roster';
+import { rarityLabel, statusLabel } from './roster';
 
-// locked    = name, stats and copy final
-// draft     = copy written, still under review
-// candidate = nominated, not yet accepted into the set
-export type Status = 'locked' | 'draft' | 'candidate';
+export type { Rarity, Status, Source };
+export { rarityLabel, statusLabel };
 
-export type Hacker = {
-  number: number;
-  slug: string;
-  name: string;
-  handle?: string;
-  title: string;
-  knownFor: string;
-  rarity: Rarity;
-  impact: number;
+export type Hacker = RosterEntry & {
   /**
    * Skill stack for the card back. Editorial ratings on the same 0-100 scale as
    * `impact`, scoped to this series — Series One rates code/community work, which
@@ -30,27 +21,7 @@ export type Hacker = {
   social: number;
   notoriety: number;
   influence: number;
-  nationality: string;
-  era: string;
-  domains: string[];
-  scouting: string;
   note: string;
-  status: Status;
-  /**
-   * Public references for the claims in `scouting`. Rendered on the card page and
-   * in the expanded roster report, so a reader can check the history rather than
-   * take our word for it. Every card in the set must carry at least one.
-   */
-  sources: Source[];
-  /** Public paths to the rendered card faces. Written by the publish step. */
-  front?: string;
-  back?: string;
-};
-
-export type Source = {
-  /** What the reader is clicking through to, not the bare URL. */
-  label: string;
-  url: string;
 };
 
 export const hackers: Hacker[] = [
@@ -868,19 +839,6 @@ export const hackers: Hacker[] = [
 
 export const totalPlanned = 30;
 
-export const rarityLabel: Record = {
-  iconic: 'Iconic',
-  legendary: 'Legendary',
-  epic: 'Epic',
-  rare: 'Rare',
-};
-
-export const statusLabel: Record = {
-  locked: 'Locked in',
-  draft: 'Copy drafted',
-  candidate: 'Nominated',
-};
-
 export const lockedCount = hackers.filter((h) => h.status === 'locked').length;
 export const draftedCount = hackers.filter((h) => h.status !== 'candidate').length;
 export const illustratedCount = hackers.filter((h) => Boolean(h.front)).length;
diff --git a/src/data/roster.ts b/src/data/roster.ts
new file mode 100644
index 0000000..0bccc9e
--- /dev/null
+++ b/src/data/roster.ts
@@ -0,0 +1,59 @@
+// Shared card vocabulary for every series. Series One is auto-generated from the
+// roster CSV and keeps its own shape; Series Two and Three are hand-curated and
+// both render through , so the fields that component reads live here.
+
+export type Rarity = 'iconic' | 'legendary' | 'epic' | 'rare';
+
+// locked    = name, stats and copy final
+// draft     = copy written, still under review
+// candidate = nominated, not yet accepted into the set
+export type Status = 'locked' | 'draft' | 'candidate';
+
+export type Source = {
+  /** What the reader is clicking through to, not the bare URL. */
+  label: string;
+  url: string;
+};
+
+/**
+ * The fields the roster grid renders. Each series extends this with its own
+ * stat block — the four bars on a card back differ set to set, because what
+ * you measure about a phone phreak is not what you measure about a CISO.
+ */
+export type RosterEntry = {
+  number: number;
+  slug: string;
+  name: string;
+  handle?: string;
+  title: string;
+  knownFor: string;
+  rarity: Rarity;
+  impact: number;
+  nationality: string;
+  era: string;
+  domains: string[];
+  scouting: string;
+  status: Status;
+  /**
+   * Public references for the claims in `scouting`. Rendered on the card page
+   * and in the expanded roster report, so a reader can check the history rather
+   * than take our word for it. Every card in every set must carry at least one.
+   */
+  sources: Source[];
+  /** Public paths to the rendered card faces. Written by the publish step. */
+  front?: string;
+  back?: string;
+};
+
+export const rarityLabel: Record = {
+  iconic: 'Iconic',
+  legendary: 'Legendary',
+  epic: 'Epic',
+  rare: 'Rare',
+};
+
+export const statusLabel: Record = {
+  locked: 'Locked in',
+  draft: 'Copy drafted',
+  candidate: 'Nominated',
+};
diff --git a/src/data/security.ts b/src/data/security.ts
new file mode 100644
index 0000000..333f2bd
--- /dev/null
+++ b/src/data/security.ts
@@ -0,0 +1,1259 @@
+// Security Professionals — Series Three. IN PROGRESS: copy is written, art is not started.
+// Hand-curated (not auto-generated). `front`/`back` will be written by the publish step
+// once portraits exist — do not hand-edit those two fields.
+//
+// The brief for this set is deliberately narrower than Series Two. Hacking Legends
+// documents the people who broke things; this one documents the people whose job was to
+// hold the line: cryptographers, defenders, tool authors, researchers and the leaders who
+// had to answer for a breach. Nobody appears in both sets.
+//
+// Every scouting report is factual and checkable. No invented quotes: `note` is editorial
+// voice, not attribution.
+
+import type { RosterEntry, Rarity, Status, Source } from './roster';
+import { rarityLabel, statusLabel } from './roster';
+
+export type { Rarity, Status, Source };
+export { rarityLabel, statusLabel };
+
+export type Pro = RosterEntry & {
+  /**
+   * Skill stack for the card back. Editorial ratings on the same 0-100 scale as
+   * `impact`, scoped to this series — Series Two rates notoriety, which is the
+   * wrong axis for people who spent careers keeping their names out of the news.
+   * These are judgements, not sourced facts.
+   */
+  technical: number;
+  /** Building and running defences that other people depend on. */
+  defense: number;
+  /** Original research: papers, disclosures, new attack or analysis classes. */
+  research: number;
+  /** How much the rest of the field changed because of them. */
+  influence: number;
+  note: string;
+};
+
+export const pros: Pro[] = [
+  {
+    number: 1,
+    slug: 'whitfield-diffie',
+    name: 'Whitfield Diffie',
+    title: 'Co-Author of Public-Key Cryptography',
+    knownFor: 'Diffie–Hellman key exchange, and the end of the shared-secret era',
+    rarity: 'iconic',
+    impact: 98,
+    technical: 96,
+    defense: 90,
+    research: 99,
+    influence: 99,
+    nationality: 'USA',
+    era: '1976–present',
+    domains: ['Cryptography', 'Key exchange', 'Policy'],
+    scouting:
+      'With Martin Hellman, published “New Directions in Cryptography” in 1976 and showed that two parties who had never met could agree on a secret over a wire anyone could read. It broke a problem the field had considered permanent, and every TLS handshake since is a descendant. Shared the 2015 Turing Award for it, and spent decades afterwards arguing the civil-liberties side of the crypto policy fights.',
+    note: 'The paper that made secure commerce on a public network conceivable at all.',
+    status: 'locked',
+    sources: [
+      { label: 'Whitfield Diffie', url: 'https://en.wikipedia.org/wiki/Whitfield_Diffie' },
+      { label: 'New Directions in Cryptography (1976)', url: 'https://ee.stanford.edu/~hellman/publications/24.pdf' },
+      { label: 'ACM A.M. Turing Award 2015', url: 'https://amturing.acm.org/award_winners/diffie_8371646.cfm' },
+    ],
+  },
+  {
+    number: 2,
+    slug: 'martin-hellman',
+    name: 'Martin Hellman',
+    title: 'Co-Author of Public-Key Cryptography',
+    knownFor: 'Diffie–Hellman, and the fight to keep crypto research public',
+    rarity: 'iconic',
+    impact: 97,
+    technical: 96,
+    defense: 88,
+    research: 98,
+    influence: 97,
+    nationality: 'USA',
+    era: '1976–present',
+    domains: ['Cryptography', 'Key exchange', 'Academic freedom'],
+    scouting:
+      'Co-author of the 1976 paper and Stanford professor who then refused to let the NSA classify academic cryptography out of existence, publishing and teaching through explicit pressure to stop. Also co-authored the early analysis of DES key length that argued, correctly and years early, that 56 bits was not enough. Shared the 2015 Turing Award with Diffie.',
+    note: 'Won the maths, then won the argument about who is allowed to do the maths.',
+    status: 'locked',
+    sources: [
+      { label: 'Martin Hellman', url: 'https://en.wikipedia.org/wiki/Martin_Hellman' },
+      { label: 'ACM A.M. Turing Award 2015', url: 'https://amturing.acm.org/award_winners/hellman_4055781.cfm' },
+    ],
+  },
+  {
+    number: 3,
+    slug: 'ron-rivest',
+    name: 'Ron Rivest',
+    title: 'The R in RSA',
+    knownFor: 'RSA, MD5, RC4 and a career of primitives everyone uses',
+    rarity: 'iconic',
+    impact: 97,
+    technical: 98,
+    defense: 90,
+    research: 97,
+    influence: 96,
+    nationality: 'USA',
+    era: '1977–present',
+    domains: ['Public-key cryptography', 'Hash functions', 'Election security'],
+    scouting:
+      'Co-invented the RSA cryptosystem at MIT in 1977 with Shamir and Adleman, turning public-key cryptography from a proposal into something you could ship. Went on to design MD2, MD4, MD5, RC4, RC5 and RC6, co-author the standard algorithms textbook, and spend his later career on verifiable election systems. Turing Award, 2002.',
+    note: 'Half the acronyms in a 1990s protocol stack trace back to one office at MIT.',
+    status: 'locked',
+    sources: [
+      { label: 'Ron Rivest', url: 'https://en.wikipedia.org/wiki/Ron_Rivest' },
+      { label: 'ACM A.M. Turing Award 2002', url: 'https://amturing.acm.org/award_winners/rivest_1403005.cfm' },
+    ],
+  },
+  {
+    number: 4,
+    slug: 'adi-shamir',
+    name: 'Adi Shamir',
+    title: 'The S in RSA',
+    knownFor: 'RSA, secret sharing, and differential cryptanalysis',
+    rarity: 'legendary',
+    impact: 96,
+    technical: 99,
+    defense: 82,
+    research: 99,
+    influence: 94,
+    nationality: 'Israel',
+    era: '1977–present',
+    domains: ['Cryptanalysis', 'Public-key cryptography', 'Secret sharing'],
+    scouting:
+      'Co-invented RSA, then invented Shamir secret sharing, then co-developed differential cryptanalysis with Eli Biham — the technique that turned out to be the one the DES designers had quietly hardened against seventeen years earlier. Also a co-author of the cube attack and a long line of side-channel work. Turing Award, 2002.',
+    note: 'Builds the lock and breaks the lock, usually in the same decade.',
+    status: 'locked',
+    sources: [
+      { label: 'Adi Shamir', url: 'https://en.wikipedia.org/wiki/Adi_Shamir' },
+      { label: 'Differential cryptanalysis', url: 'https://en.wikipedia.org/wiki/Differential_cryptanalysis' },
+    ],
+  },
+  {
+    number: 5,
+    slug: 'leonard-adleman',
+    name: 'Leonard Adleman',
+    title: 'The A in RSA',
+    knownFor: 'RSA, and naming the computer virus',
+    rarity: 'epic',
+    impact: 92,
+    technical: 95,
+    defense: 80,
+    research: 96,
+    influence: 90,
+    nationality: 'USA',
+    era: '1977–present',
+    domains: ['Public-key cryptography', 'Complexity theory', 'DNA computing'],
+    scouting:
+      'The third name on the RSA paper, whose role was to keep breaking the schemes Rivest and Shamir proposed until one survived. Later coined the term “computer virus” for Fred Cohen’s 1983 experiments, and founded DNA computing with a molecular solution to the Hamiltonian path problem. Turing Award, 2002.',
+    note: 'The designated attacker on the RSA team. The set needs more of those.',
+    status: 'locked',
+    sources: [
+      { label: 'Leonard Adleman', url: 'https://en.wikipedia.org/wiki/Leonard_Adleman' },
+      { label: 'ACM A.M. Turing Award 2002', url: 'https://amturing.acm.org/award_winners/adleman_7308544.cfm' },
+    ],
+  },
+  {
+    number: 6,
+    slug: 'phil-zimmermann',
+    name: 'Phil Zimmermann',
+    title: 'Author of PGP',
+    knownFor: 'Putting strong crypto in ordinary hands, and getting investigated for it',
+    rarity: 'iconic',
+    impact: 96,
+    technical: 88,
+    defense: 95,
+    research: 78,
+    influence: 97,
+    nationality: 'USA',
+    era: '1991–present',
+    domains: ['Email encryption', 'Crypto policy', 'Secure voice'],
+    scouting:
+      'Released Pretty Good Privacy as free software in 1991, and it escaped onto the internet worldwide. The US government opened a three-year criminal investigation into him for munitions export, dropped it in 1996 without charges, and the crypto-export regime never recovered. He later co-founded Silent Circle and worked on ZRTP for encrypted voice.',
+    note: 'The card for everyone who has ever typed a passphrase to read their own mail.',
+    status: 'locked',
+    sources: [
+      { label: 'Phil Zimmermann', url: 'https://en.wikipedia.org/wiki/Phil_Zimmermann' },
+      { label: 'Pretty Good Privacy', url: 'https://en.wikipedia.org/wiki/Pretty_Good_Privacy' },
+    ],
+  },
+  {
+    number: 7,
+    slug: 'bruce-schneier',
+    name: 'Bruce Schneier',
+    title: 'The Field’s Public Conscience',
+    knownFor: 'Applied Cryptography, Blowfish, and “security theatre”',
+    rarity: 'iconic',
+    impact: 95,
+    technical: 88,
+    defense: 90,
+    research: 88,
+    influence: 98,
+    nationality: 'USA',
+    era: '1994–present',
+    domains: ['Cryptography', 'Security economics', 'Public policy'],
+    scouting:
+      'Wrote Applied Cryptography in 1994, the book that taught a generation of engineers how ciphers actually work, then designed Blowfish and co-designed Twofish. Spent the two decades after arguing the harder point: that security is a systems and incentives problem, not a maths problem. Coined “security theatre”, has written the Crypto-Gram newsletter since 1998, and helped report on the Snowden documents.',
+    note: 'More people entered this field because of one book than any other single cause.',
+    status: 'locked',
+    sources: [
+      { label: 'Bruce Schneier', url: 'https://en.wikipedia.org/wiki/Bruce_Schneier' },
+      { label: 'Schneier on Security', url: 'https://www.schneier.com/' },
+    ],
+  },
+  {
+    number: 8,
+    slug: 'paul-kocher',
+    name: 'Paul Kocher',
+    title: 'The Side-Channel Pioneer',
+    knownFor: 'Timing attacks, differential power analysis, and Spectre',
+    rarity: 'legendary',
+    impact: 94,
+    technical: 98,
+    defense: 88,
+    research: 98,
+    influence: 92,
+    nationality: 'USA',
+    era: '1995–present',
+    domains: ['Side channels', 'Hardware security', 'TLS'],
+    scouting:
+      'Published the timing-attack paper in 1996 and differential power analysis in 1999, establishing that a correct implementation of a correct algorithm can still leak its key through how long it takes or how much current it draws. Co-authored the SSL 3.0 specification, founded Cryptography Research, and in 2018 was one of the co-discoverers of Spectre.',
+    note: 'Twice made the whole industry re-audit hardware it had already shipped.',
+    status: 'locked',
+    sources: [
+      { label: 'Paul Kocher', url: 'https://en.wikipedia.org/wiki/Paul_Kocher' },
+      { label: 'Spectre (security vulnerability)', url: 'https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)' },
+      { label: 'Differential Power Analysis (1999)', url: 'https://www.paulkocher.com/doc/DifferentialPowerAnalysis.pdf' },
+    ],
+  },
+  {
+    number: 9,
+    slug: 'dorothy-denning',
+    name: 'Dorothy E. Denning',
+    title: 'Founder of Intrusion Detection',
+    knownFor: 'The 1987 intrusion-detection model every SIEM still runs on',
+    rarity: 'iconic',
+    impact: 94,
+    technical: 90,
+    defense: 97,
+    research: 96,
+    influence: 94,
+    nationality: 'USA',
+    era: '1975–present',
+    domains: ['Intrusion detection', 'Information warfare', 'Crypto policy'],
+    scouting:
+      'Published “An Intrusion-Detection Model” in 1987, the paper that framed detection as statistical deviation from a profile of normal behaviour and gave the entire monitoring industry its foundation. Also wrote Cryptography and Data Security, worked on database security and lattice-based information flow, and was one of the few academics engaging seriously with both sides of the Clipper chip debate.',
+    note: 'Every alert queue in every SOC is downstream of one 1987 paper.',
+    status: 'locked',
+    sources: [
+      { label: 'Dorothy E. Denning', url: 'https://en.wikipedia.org/wiki/Dorothy_E._Denning' },
+      { label: 'An Intrusion-Detection Model (1987)', url: 'https://www.cs.colostate.edu/~cs656/reading/ieee-se-13-2.pdf' },
+    ],
+  },
+  {
+    number: 10,
+    slug: 'gene-spafford',
+    name: 'Gene Spafford',
+    handle: 'Spaf',
+    title: 'The Academy’s Anchor',
+    knownFor: 'The Morris worm analysis, Practical UNIX Security, and CERIAS',
+    rarity: 'legendary',
+    impact: 92,
+    technical: 90,
+    defense: 94,
+    research: 92,
+    influence: 94,
+    nationality: 'USA',
+    era: '1988–present',
+    domains: ['Systems security', 'Forensics', 'Security education'],
+    scouting:
+      'Produced one of the first detailed technical analyses of the 1988 Morris worm while the internet was still smoking, co-wrote Practical UNIX and Internet Security with Simson Garfinkel, co-created Tripwire, and founded Purdue’s COAST lab and then CERIAS — for years the largest academic security centre in the US. Has advised more federal panels than most people have attended.',
+    note: 'Trained a large fraction of the people on the rest of these cards.',
+    status: 'locked',
+    sources: [
+      { label: 'Gene Spafford', url: 'https://en.wikipedia.org/wiki/Gene_Spafford' },
+      { label: 'CERIAS, Purdue University', url: 'https://www.cerias.purdue.edu/' },
+    ],
+  },
+  {
+    number: 11,
+    slug: 'ross-anderson',
+    name: 'Ross Anderson',
+    title: 'Author of Security Engineering',
+    knownFor: 'The textbook, and the economics of why security fails',
+    rarity: 'iconic',
+    impact: 94,
+    technical: 94,
+    defense: 92,
+    research: 97,
+    influence: 96,
+    nationality: 'UK',
+    era: '1991–2024',
+    domains: ['Security engineering', 'Security economics', 'Banking systems'],
+    scouting:
+      'Cambridge professor who wrote Security Engineering, the closest thing the field has to a canonical text, and gave away earlier editions free online. Founded the security-economics research programme with the observation that systems fail because the people who could fix them are not the people who bear the loss. Spent years demonstrating that bank chip-and-PIN systems were weaker than the banks told courts they were. Died in 2024.',
+    note: 'If you only read one book on this list, it is this one.',
+    status: 'locked',
+    sources: [
+      { label: 'Ross J. Anderson', url: 'https://en.wikipedia.org/wiki/Ross_J._Anderson' },
+      { label: 'Security Engineering, third edition', url: 'https://www.cl.cam.ac.uk/~rja14/book.html' },
+    ],
+  },
+  {
+    number: 12,
+    slug: 'matt-blaze',
+    name: 'Matt Blaze',
+    title: 'The Clipper Chip Breaker',
+    knownFor: 'Killing key escrow, then auditing the voting machines',
+    rarity: 'legendary',
+    impact: 92,
+    technical: 94,
+    defense: 88,
+    research: 95,
+    influence: 93,
+    nationality: 'USA',
+    era: '1994–present',
+    domains: ['Cryptography', 'Election security', 'Physical security'],
+    scouting:
+      'Found the protocol flaw in the NSA’s Clipper chip escrow scheme in 1994 and published it, which did more to end mandated key escrow than any amount of lobbying. Later led state-commissioned source reviews of US voting systems, published work on the vulnerabilities of master-keyed physical locks and wiretap systems, and became a law-school professor arguing the same points to a different audience.',
+    note: 'Has broken the government’s preferred backdoor design once already.',
+    status: 'locked',
+    sources: [
+      { label: 'Matt Blaze', url: 'https://en.wikipedia.org/wiki/Matt_Blaze' },
+      { label: 'Protocol Failure in the Escrowed Encryption Standard (1994)', url: 'https://www.mattblaze.org/papers/eesproto.pdf' },
+    ],
+  },
+  {
+    number: 13,
+    slug: 'radia-perlman',
+    name: 'Radia Perlman',
+    title: 'Architect of Resilient Networks',
+    knownFor: 'Spanning tree, and routing that survives a malicious node',
+    rarity: 'legendary',
+    impact: 91,
+    technical: 96,
+    defense: 92,
+    research: 92,
+    influence: 92,
+    nationality: 'USA',
+    era: '1985–present',
+    domains: ['Network protocols', 'PKI', 'Secure deletion'],
+    scouting:
+      'Invented the spanning-tree protocol that made large bridged Ethernets possible, and did the early work on routing protocols designed to keep functioning when a participating node is actively hostile rather than merely broken. Co-wrote Network Security: Private Communication in a Public World, and designed the “ephemerizer” approach to making data reliably expire.',
+    note: 'Designed for the assumption that some of the network is lying to you.',
+    status: 'locked',
+    sources: [
+      { label: 'Radia Perlman', url: 'https://en.wikipedia.org/wiki/Radia_Perlman' },
+      { label: 'Internet Hall of Fame profile', url: 'https://www.internethalloffame.org/inductee/radia-perlman/' },
+    ],
+  },
+  {
+    number: 14,
+    slug: 'steven-bellovin',
+    name: 'Steven M. Bellovin',
+    title: 'The Protocol Sceptic',
+    knownFor: 'Security Problems in the TCP/IP Protocol Suite, and the firewall book',
+    rarity: 'legendary',
+    impact: 91,
+    technical: 94,
+    defense: 94,
+    research: 94,
+    influence: 91,
+    nationality: 'USA',
+    era: '1989–present',
+    domains: ['Network security', 'Protocol design', 'Policy'],
+    scouting:
+      'Wrote the 1989 paper cataloguing the security problems in TCP/IP — sequence-number prediction, source routing, DNS spoofing — years before anyone was exploiting them at scale. Co-authored Firewalls and Internet Security with Cheswick, co-invented encrypted key exchange, was a Usenet co-creator, and served as chief technologist at the FTC and on the Privacy and Civil Liberties Oversight Board.',
+    note: 'Published the attack list first and spent thirty years watching it come true.',
+    status: 'locked',
+    sources: [
+      { label: 'Steven M. Bellovin', url: 'https://en.wikipedia.org/wiki/Steven_M._Bellovin' },
+      { label: 'Security Problems in the TCP/IP Protocol Suite (1989)', url: 'https://www.cs.columbia.edu/~smb/papers/ipext.pdf' },
+    ],
+  },
+  {
+    number: 15,
+    slug: 'william-cheswick',
+    name: 'William Cheswick',
+    handle: 'Ches',
+    title: 'The First Firewall Book',
+    knownFor: 'Firewalls and Internet Security, and “An Evening with Berferd”',
+    rarity: 'epic',
+    impact: 88,
+    technical: 92,
+    defense: 94,
+    research: 88,
+    influence: 89,
+    nationality: 'USA',
+    era: '1990–present',
+    domains: ['Firewalls', 'Honeypots', 'Internet mapping'],
+    scouting:
+      'Co-wrote the 1994 book that taught the industry what a firewall was and how to reason about a perimeter. “An Evening with Berferd” documented him feeding a live intruder a fake environment for months and writing down everything, which is the honeypot genre’s founding text. Later ran the Internet Mapping Project at Bell Labs.',
+    note: 'Invented the practice of watching the attacker instead of just shutting the door.',
+    status: 'locked',
+    sources: [
+      { label: 'William Cheswick', url: 'https://en.wikipedia.org/wiki/William_Cheswick' },
+      { label: 'An Evening with Berferd (1992)', url: 'https://www.cheswick.com/ches/papers/berferd.pdf' },
+    ],
+  },
+  {
+    number: 16,
+    slug: 'marcus-ranum',
+    name: 'Marcus J. Ranum',
+    title: 'Builder of the First Commercial Firewall',
+    knownFor: 'DEC SEAL, the TIS toolkit, and thirty years of contrarianism',
+    rarity: 'legendary',
+    impact: 89,
+    technical: 92,
+    defense: 96,
+    research: 84,
+    influence: 90,
+    nationality: 'USA',
+    era: '1990–present',
+    domains: ['Firewalls', 'Proxies', 'Logging'],
+    scouting:
+      'Built DEC SEAL, generally credited as the first commercial firewall product, then the TIS Firewall Toolkit and Gauntlet — the code most early internet perimeters were actually made of. Ran whitehouse.gov’s first email server. Has spent the decades since publicly arguing that most of what the industry sells does not work, which has aged better than the products did.',
+    note: 'The perimeter, as an idea people could buy, is largely his fault and his credit.',
+    status: 'locked',
+    sources: [
+      { label: 'Marcus J. Ranum', url: 'https://en.wikipedia.org/wiki/Marcus_J._Ranum' },
+      { label: 'Firewall (computing) — history', url: 'https://en.wikipedia.org/wiki/Firewall_(computing)' },
+    ],
+  },
+  {
+    number: 17,
+    slug: 'wietse-venema',
+    name: 'Wietse Venema',
+    title: 'Author of TCP Wrapper and Postfix',
+    knownFor: 'Defensive software that a generation of admins just ran',
+    rarity: 'legendary',
+    impact: 90,
+    technical: 96,
+    defense: 97,
+    research: 86,
+    influence: 90,
+    nationality: 'Netherlands',
+    era: '1990–present',
+    domains: ['Host security', 'Mail security', 'Forensics'],
+    scouting:
+      'Wrote TCP Wrapper, which for years was the access control on a very large share of Unix hosts on the internet, and Postfix, a mail server written from the start around privilege separation. Co-wrote SATAN with Dan Farmer and later the Coroner’s Toolkit and Forensic Discovery, giving incident responders their first real open tooling.',
+    note: 'Shipped the defence, then shipped the tools to work out how it was beaten.',
+    status: 'locked',
+    sources: [
+      { label: 'Wietse Venema', url: 'https://en.wikipedia.org/wiki/Wietse_Venema' },
+      { label: 'Postfix', url: 'https://www.postfix.org/' },
+    ],
+  },
+  {
+    number: 18,
+    slug: 'dan-farmer',
+    name: 'Dan Farmer',
+    title: 'Author of COPS and SATAN',
+    knownFor: 'Publishing the scanner, and getting fired for it',
+    rarity: 'epic',
+    impact: 87,
+    technical: 90,
+    defense: 88,
+    research: 90,
+    influence: 89,
+    nationality: 'USA',
+    era: '1990–present',
+    domains: ['Vulnerability scanning', 'Forensics', 'Host auditing'],
+    scouting:
+      'Wrote COPS as a student, then in 1995 released SATAN with Wietse Venema — a scanner that audited a network the way an attacker would, published openly so defenders could run it first. The press predicted the end of the internet; SGI fired him over it; the security scanner became a permanent product category. Later co-wrote Forensic Discovery.',
+    note: 'The original argument that defenders should get the attacker’s tools too.',
+    status: 'locked',
+    sources: [
+      { label: 'Dan Farmer', url: 'https://en.wikipedia.org/wiki/Dan_Farmer' },
+      { label: 'SATAN', url: 'https://en.wikipedia.org/wiki/Security_Administrator_Tool_for_Analyzing_Networks' },
+    ],
+  },
+  {
+    number: 19,
+    slug: 'gordon-lyon',
+    name: 'Gordon Lyon',
+    handle: 'Fyodor',
+    title: 'Author of Nmap',
+    knownFor: 'The scanner that is on every security laptop on earth',
+    rarity: 'iconic',
+    impact: 93,
+    technical: 94,
+    defense: 92,
+    research: 86,
+    influence: 95,
+    nationality: 'USA',
+    era: '1997–present',
+    domains: ['Network scanning', 'OS fingerprinting', 'Open source'],
+    scouting:
+      'Released Nmap in Phrack in 1997 and has maintained it ever since, adding OS fingerprinting, service detection and the NSE scripting engine. Runs seclists.org, hosting the Bugtraq and Full Disclosure archives that are the field’s institutional memory, and fought MPAA and studio takedown attempts over the tool. Nmap is the first command most defenders learn.',
+    note: 'Twenty-eight years of one maintainer. The reliability is the achievement.',
+    status: 'locked',
+    sources: [
+      { label: 'Gordon Lyon', url: 'https://en.wikipedia.org/wiki/Gordon_Lyon' },
+      { label: 'Nmap', url: 'https://nmap.org/' },
+    ],
+  },
+  {
+    number: 20,
+    slug: 'martin-roesch',
+    name: 'Martin Roesch',
+    title: 'Author of Snort',
+    knownFor: 'Open-source intrusion detection, and the rule format everyone copied',
+    rarity: 'epic',
+    impact: 89,
+    technical: 92,
+    defense: 96,
+    research: 84,
+    influence: 91,
+    nationality: 'USA',
+    era: '1998–present',
+    domains: ['Intrusion detection', 'Packet analysis', 'Open source'],
+    scouting:
+      'Wrote Snort in 1998 as a lightweight packet sniffer, and it became the intrusion detection system that put IDS within reach of organisations that could never have bought one. Founded Sourcefire around it, which Cisco acquired in 2013. The Snort rule syntax outlived the product and is still how a large part of the industry writes network detections.',
+    note: 'A weekend tool that became the de facto standard for network detection.',
+    status: 'locked',
+    sources: [
+      { label: 'Martin Roesch', url: 'https://en.wikipedia.org/wiki/Martin_Roesch' },
+      { label: 'Snort', url: 'https://www.snort.org/' },
+    ],
+  },
+  {
+    number: 21,
+    slug: 'gerald-combs',
+    name: 'Gerald Combs',
+    title: 'Author of Wireshark',
+    knownFor: 'Making packet analysis free, and keeping it free',
+    rarity: 'epic',
+    impact: 88,
+    technical: 91,
+    defense: 93,
+    research: 78,
+    influence: 92,
+    nationality: 'USA',
+    era: '1998–present',
+    domains: ['Packet analysis', 'Protocol dissection', 'Open source'],
+    scouting:
+      'Started Ethereal in 1998 because commercial protocol analysers cost more than his employer would spend, renamed it Wireshark in 2006 after a trademark problem, and has shepherded it ever since through thousands of contributed protocol dissectors. It is the default answer to “what is actually on the wire” for network engineers and incident responders alike.',
+    note: 'The tool you reach for when nobody can agree on what the traffic is doing.',
+    status: 'locked',
+    sources: [
+      { label: 'Wireshark', url: 'https://en.wikipedia.org/wiki/Wireshark' },
+      { label: 'Wireshark project', url: 'https://www.wireshark.org/about.html' },
+    ],
+  },
+  {
+    number: 22,
+    slug: 'renaud-deraison',
+    name: 'Renaud Deraison',
+    title: 'Author of Nessus',
+    knownFor: 'The vulnerability scanner that defined the category',
+    rarity: 'epic',
+    impact: 87,
+    technical: 91,
+    defense: 94,
+    research: 82,
+    influence: 89,
+    nationality: 'France / USA',
+    era: '1998–present',
+    domains: ['Vulnerability management', 'Scanning', 'Product security'],
+    scouting:
+      'Released Nessus in 1998 as a free scanner with its own plugin language, at a point when the alternative was an expensive appliance. Co-founded Tenable Network Security around it in 2002 and took the product closed-source in 2005, a decision the community argued about for years. Vulnerability management as a routine operational practice largely grew out of that codebase.',
+    note: 'The scan report that lands in an admin’s inbox every Monday started here.',
+    status: 'locked',
+    sources: [
+      { label: 'Nessus (software)', url: 'https://en.wikipedia.org/wiki/Nessus_(software)' },
+      { label: 'Tenable leadership', url: 'https://www.tenable.com/about-tenable/leadership' },
+    ],
+  },
+  {
+    number: 23,
+    slug: 'paul-vixie',
+    name: 'Paul Vixie',
+    title: 'Keeper of the DNS',
+    knownFor: 'BIND, DNS RPZ, and the anti-abuse infrastructure nobody sees',
+    rarity: 'legendary',
+    impact: 90,
+    technical: 95,
+    defense: 95,
+    research: 86,
+    influence: 92,
+    nationality: 'USA',
+    era: '1988–present',
+    domains: ['DNS', 'Anti-abuse', 'Internet infrastructure'],
+    scouting:
+      'Maintained BIND for years and wrote or co-wrote a long run of DNS RFCs, then built the response-policy zone mechanism that lets defenders block malicious domains at the resolver. Founded the first anti-spam DNSBL, ran the Internet Software Consortium, operates F-root, and co-founded Farsight Security around passive DNS. Internet Hall of Fame, 2014.',
+    note: 'Ran the plumbing, then built the filters when the plumbing got abused.',
+    status: 'locked',
+    sources: [
+      { label: 'Paul Vixie', url: 'https://en.wikipedia.org/wiki/Paul_Vixie' },
+      { label: 'Internet Hall of Fame profile', url: 'https://www.internethalloffame.org/inductee/paul-vixie/' },
+    ],
+  },
+  {
+    number: 24,
+    slug: 'niels-provos',
+    name: 'Niels Provos',
+    title: 'Honeypots and Safe Browsing',
+    knownFor: 'honeyd, bcrypt, and warning a billion browsers',
+    rarity: 'epic',
+    impact: 88,
+    technical: 95,
+    defense: 94,
+    research: 92,
+    influence: 88,
+    nationality: 'Germany / USA',
+    era: '1999–present',
+    domains: ['Honeypots', 'Password hashing', 'Web malware'],
+    scouting:
+      'Wrote honeyd, co-designed the bcrypt password hash with David Mazières, and created systrace and privilege separation work in OpenSSH. At Google he led the Safe Browsing malware research that put interstitial warnings in front of drive-by download sites, and co-authored the papers that measured how large that problem actually was.',
+    note: 'bcrypt alone has protected more passwords than most companies have users.',
+    status: 'locked',
+    sources: [
+      { label: 'Niels Provos', url: 'https://en.wikipedia.org/wiki/Niels_Provos' },
+      { label: 'A Future-Adaptable Password Scheme (bcrypt, 1999)', url: 'https://www.usenix.org/legacy/events/usenix99/provos/provos.pdf' },
+    ],
+  },
+  {
+    number: 25,
+    slug: 'jeremiah-grossman',
+    name: 'Jeremiah Grossman',
+    title: 'The Web Application Security Authority',
+    knownFor: 'XSS Attacks, WhiteHat Security, and making web appsec a discipline',
+    rarity: 'legendary',
+    impact: 90,
+    technical: 90,
+    defense: 94,
+    research: 93,
+    influence: 93,
+    nationality: 'USA',
+    era: '1999–present',
+    domains: ['Web application security', 'Cross-site scripting', 'Vulnerability data'],
+    scouting:
+      'Was an information security officer at Yahoo before founding WhiteHat Security in 2001, where continuous scanning of thousands of production sites produced the first credible public statistics on how long real web vulnerabilities actually stay open. Co-founded the Web Application Security Consortium, and co-authored XSS Attacks: Cross Site Scripting Exploits and Defense in 2007 — the book that turned cross-site scripting from a curiosity into a class of bug developers were expected to know.',
+    note: 'Named on the request. Earns the slot anyway: the XSS book is the reference.',
+    status: 'locked',
+    sources: [
+      { label: 'XSS Attacks: Cross Site Scripting Exploits and Defense', url: 'https://books.google.com/books/about/XSS_Attacks.html?id=FKN5uL57tyAC' },
+      { label: 'Jeremiah Grossman’s blog', url: 'https://blog.jeremiahgrossman.com/' },
+      { label: 'Web Application Security Consortium', url: 'http://www.webappsec.org/' },
+    ],
+  },
+  {
+    number: 26,
+    slug: 'robert-hansen',
+    name: 'Robert Hansen',
+    handle: 'RSnake',
+    title: 'The XSS Cheat Sheet',
+    knownFor: 'ha.ckers.org, Slowloris, and browser attack surface',
+    rarity: 'epic',
+    impact: 85,
+    technical: 90,
+    defense: 84,
+    research: 92,
+    influence: 86,
+    nationality: 'USA',
+    era: '2005–present',
+    domains: ['Cross-site scripting', 'Browser security', 'Denial of service'],
+    scouting:
+      'Ran ha.ckers.org and published the XSS cheat sheet, which for years was the reference list of filter-evasion payloads that every web application firewall was tested against. Co-authored XSS Attacks with Grossman, released Slowloris to demonstrate that a single machine could hold a web server’s connections open indefinitely, and co-wrote Detecting Malice on behavioural detection.',
+    note: 'The cheat sheet did more for input validation than any standards document.',
+    status: 'locked',
+    sources: [
+      { label: 'XSS Attacks: Cross Site Scripting Exploits and Defense', url: 'https://books.google.com/books/about/XSS_Attacks.html?id=FKN5uL57tyAC' },
+      { label: 'Slowloris (computer security)', url: 'https://en.wikipedia.org/wiki/Slowloris_(cyber_attack)' },
+    ],
+  },
+  {
+    number: 27,
+    slug: 'mark-curphey',
+    name: 'Mark Curphey',
+    title: 'Founder of OWASP',
+    knownFor: 'Starting the open project that appsec organised itself around',
+    rarity: 'epic',
+    impact: 87,
+    technical: 84,
+    defense: 92,
+    research: 80,
+    influence: 93,
+    nationality: 'UK / USA',
+    era: '2001–present',
+    domains: ['Application security', 'Open standards', 'Supply chain'],
+    scouting:
+      'Started the Open Web Application Security Project in September 2001 as a mailing list and a few documents, and it became the vendor-neutral body that produced the Top Ten, the ASVS, ZAP and the testing guides that appsec teams still work from. Later founded SourceClear on software composition analysis and has kept publicly pushing OWASP to stay relevant to modern supply-chain risk.',
+    note: 'Built the commons the whole application security industry now cites.',
+    status: 'locked',
+    sources: [
+      { label: 'OWASP', url: 'https://en.wikipedia.org/wiki/OWASP' },
+      { label: 'Mark Curphey — OWASP Foundation', url: 'https://owasp.org/www-board-candidates/2022/mark_curphey_2022' },
+    ],
+  },
+  {
+    number: 28,
+    slug: 'jeff-williams',
+    name: 'Jeff Williams',
+    title: 'Author of the First OWASP Top Ten',
+    knownFor: 'The list every compliance regime ended up pointing at',
+    rarity: 'epic',
+    impact: 86,
+    technical: 88,
+    defense: 92,
+    research: 82,
+    influence: 90,
+    nationality: 'USA',
+    era: '2002–present',
+    domains: ['Application security', 'Runtime protection', 'Standards'],
+    scouting:
+      'Wrote the first OWASP Top Ten and served as the volunteer chair of OWASP from 2003 to 2011, the years in which it went from a mailing list to the reference that PCI DSS and a long line of other standards cite by name. Co-founded Aspect Security and then Contrast Security, arguing for instrumentation inside the running application rather than scanning it from outside.',
+    note: 'One list, and suddenly every auditor knew what SQL injection was.',
+    status: 'locked',
+    sources: [
+      { label: 'OWASP', url: 'https://en.wikipedia.org/wiki/OWASP' },
+      { label: 'OWASP Top Ten project', url: 'https://owasp.org/www-project-top-ten/' },
+    ],
+  },
+  {
+    number: 29,
+    slug: 'gary-mcgraw',
+    name: 'Gary McGraw',
+    title: 'Building Security In',
+    knownFor: 'Software security as a discipline, and BSIMM',
+    rarity: 'epic',
+    impact: 86,
+    technical: 86,
+    defense: 92,
+    research: 88,
+    influence: 90,
+    nationality: 'USA',
+    era: '1997–present',
+    domains: ['Software security', 'Secure design', 'Measurement'],
+    scouting:
+      'Wrote Building Secure Software, Exploiting Software and Software Security, making the case that you cannot test defects out of a system you designed insecurely. Co-created BSIMM, which measures what security programmes actually do rather than what a standard says they should, and has run a long-standing interview series documenting the field’s own history.',
+    note: 'Moved the argument from “scan it later” to “design it right”.',
+    status: 'locked',
+    sources: [
+      { label: 'Gary McGraw', url: 'https://en.wikipedia.org/wiki/Gary_McGraw' },
+      { label: 'BSIMM', url: 'https://www.bsimm.com/' },
+    ],
+  },
+  {
+    number: 30,
+    slug: 'michael-howard',
+    name: 'Michael Howard',
+    title: 'Author of Writing Secure Code',
+    knownFor: 'The book and the process behind Microsoft’s security turnaround',
+    rarity: 'epic',
+    impact: 87,
+    technical: 90,
+    defense: 94,
+    research: 80,
+    influence: 91,
+    nationality: 'New Zealand / USA',
+    era: '2001–present',
+    domains: ['Secure development', 'SDL', 'Threat modelling'],
+    scouting:
+      'Co-wrote Writing Secure Code, which Bill Gates ordered Windows engineers to read during the 2002 Trustworthy Computing halt, and helped build the Security Development Lifecycle that came out of it — threat modelling, banned APIs, fuzzing and a final security review before ship. The SDL became the template most large software organisations copied.',
+    note: 'Turned “be careful” into a checklist an entire company could be held to.',
+    status: 'locked',
+    sources: [
+      { label: 'Microsoft Security Development Lifecycle', url: 'https://en.wikipedia.org/wiki/Microsoft_Security_Development_Lifecycle' },
+      { label: 'Writing Secure Code, second edition', url: 'https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223' },
+    ],
+  },
+  {
+    number: 31,
+    slug: 'adam-shostack',
+    name: 'Adam Shostack',
+    title: 'The Threat Modelling Canon',
+    knownFor: 'Threat Modeling: Designing for Security, and STRIDE in practice',
+    rarity: 'epic',
+    impact: 85,
+    technical: 86,
+    defense: 92,
+    research: 84,
+    influence: 89,
+    nationality: 'USA / Canada',
+    era: '2003–present',
+    domains: ['Threat modelling', 'Privacy', 'Security design'],
+    scouting:
+      'Drove threat modelling into shippable practice at Microsoft, including the Elevation of Privilege card game that got non-security engineers doing it voluntarily, then wrote Threat Modeling: Designing for Security and later Threats: What Every Engineer Should Learn. Served on the CVE editorial board and co-wrote The New School of Information Security on learning from breach data.',
+    note: 'Four questions — what are we building, what can go wrong, what do we do, did we do a good job.',
+    status: 'locked',
+    sources: [
+      { label: 'Adam Shostack’s site', url: 'https://shostack.org/about/adam' },
+      { label: 'Elevation of Privilege threat modelling game', url: 'https://shostack.org/games/elevation-of-privilege' },
+    ],
+  },
+  {
+    number: 32,
+    slug: 'ivan-ristic',
+    name: 'Ivan Ristić',
+    title: 'Author of ModSecurity and SSL Labs',
+    knownFor: 'Grading the internet’s TLS, one hostname at a time',
+    rarity: 'epic',
+    impact: 86,
+    technical: 92,
+    defense: 95,
+    research: 86,
+    influence: 88,
+    nationality: 'Croatia / UK',
+    era: '2002–present',
+    domains: ['TLS', 'Web application firewalls', 'Measurement'],
+    scouting:
+      'Wrote ModSecurity, the open-source web application firewall that became the reference implementation and the base of the OWASP Core Rule Set. Then built SSL Labs, whose A-to-F grade for a server’s TLS configuration turned an obscure ops detail into something executives asked about, and wrote Bulletproof TLS and PKI as the manual for fixing the grade.',
+    note: 'Made bad TLS visible and embarrassing, which fixed more of it than any RFC.',
+    status: 'locked',
+    sources: [
+      { label: 'Ivan Ristić', url: 'https://en.wikipedia.org/wiki/Ivan_Risti%C4%87' },
+      { label: 'Qualys SSL Labs', url: 'https://www.ssllabs.com/' },
+    ],
+  },
+  {
+    number: 33,
+    slug: 'mark-dowd',
+    name: 'Mark Dowd',
+    title: 'The Art of Software Security Assessment',
+    knownFor: 'The code-audit bible, and the Sendmail and Flash bugs behind it',
+    rarity: 'rare',
+    impact: 84,
+    technical: 98,
+    defense: 82,
+    research: 94,
+    influence: 84,
+    nationality: 'Australia',
+    era: '2002–present',
+    domains: ['Code auditing', 'Memory corruption', 'Exploit mitigation'],
+    scouting:
+      'Co-wrote The Art of Software Security Assessment with John McDonald and Justin Schuh, still the most thorough published treatment of how to find memory-safety and logic flaws by reading code. Found deep bugs in Sendmail, OpenSSH and Flash while at ISS X-Force and IBM, and founded Azimuth Security. His work is why a generation of auditors know what to look for in a parser.',
+    note: 'The book that turned code review from a chore into a craft.',
+    status: 'locked',
+    sources: [
+      { label: 'The Art of Software Security Assessment', url: 'https://www.informit.com/store/art-of-software-security-assessment-identifying-and-9780321444424' },
+      { label: 'Azimuth Security', url: 'https://www.azimuthsecurity.com/' },
+    ],
+  },
+  {
+    number: 34,
+    slug: 'halvar-flake',
+    name: 'Thomas Dullien',
+    handle: 'Halvar Flake',
+    title: 'The Binary Diffing Pioneer',
+    knownFor: 'BinDiff, and the theory of weird machines',
+    rarity: 'epic',
+    impact: 85,
+    technical: 97,
+    defense: 86,
+    research: 95,
+    influence: 86,
+    nationality: 'Germany',
+    era: '2000–present',
+    domains: ['Reverse engineering', 'Patch analysis', 'Exploit theory'],
+    scouting:
+      'Built the graph-based binary diffing that made it routine to extract the vulnerability out of a vendor patch, founded zynamics around BinDiff and VxClass, and sold it to Google in 2011. Later worked in Project Zero and wrote the “weird machines” framing that treats exploitation as programming an unintended state machine inside the target.',
+    note: 'Turned Patch Tuesday into a reliable source of exploit intelligence.',
+    status: 'locked',
+    sources: [
+      { label: 'BinDiff', url: 'https://www.zynamics.com/bindiff.html' },
+      { label: 'Thomas Dullien’s research blog', url: 'https://addxorrol.blogspot.com/' },
+    ],
+  },
+  {
+    number: 35,
+    slug: 'alex-sotirov',
+    name: 'Alex Sotirov',
+    title: 'The Rogue CA Demonstration',
+    knownFor: 'MD5 collisions against a real certificate authority',
+    rarity: 'rare',
+    impact: 83,
+    technical: 96,
+    defense: 84,
+    research: 94,
+    influence: 84,
+    nationality: 'Bulgaria / USA',
+    era: '2007–present',
+    domains: ['PKI', 'Exploit mitigation', 'Browser security'],
+    scouting:
+      'Co-authored “Bypassing Browser Memory Protections”, the 2008 paper that showed how attackers were routing around DEP and ASLR, then at 25C3 the same year demonstrated a working rogue certificate authority built on MD5 collisions — which pushed the CA industry off MD5 for good. Co-founded Trail of Bits.',
+    note: 'Demonstrated the theoretical break against a live CA, which is the only kind that moves anyone.',
+    status: 'locked',
+    sources: [
+      { label: 'MD5 considered harmful today (2008)', url: 'https://www.win.tue.nl/hashclash/rogue-ca/' },
+      { label: 'Bypassing Browser Memory Protections (2008)', url: 'https://www.blackhat.com/presentations/bh-usa-08/Sotirov_Dowd/bh08-sotirov-dowd.pdf' },
+    ],
+  },
+  {
+    number: 36,
+    slug: 'thomas-ptacek',
+    name: 'Thomas Ptacek',
+    title: 'The IDS Evasion Paper',
+    knownFor: 'Insertion, Evasion and Denial of Service, and Matasano',
+    rarity: 'rare',
+    impact: 82,
+    technical: 94,
+    defense: 88,
+    research: 92,
+    influence: 85,
+    nationality: 'USA',
+    era: '1998–present',
+    domains: ['Intrusion detection', 'Cryptographic review', 'Appsec consulting'],
+    scouting:
+      'Co-wrote the 1998 paper with Timothy Newsham showing that a network IDS which reassembles traffic differently from the host it protects can be walked straight past — the work that forced every vendor to rethink normalisation. Co-founded Matasano and later Latacora, and wrote the Cryptopals challenges that taught a generation how crypto actually breaks.',
+    note: 'One paper made every IDS vendor rewrite their TCP stack.',
+    status: 'locked',
+    sources: [
+      { label: 'Insertion, Evasion, and Denial of Service (1998)', url: 'https://insecure.org/stf/secnet_ids/secnet_ids.html' },
+      { label: 'The Cryptopals crypto challenges', url: 'https://cryptopals.com/' },
+    ],
+  },
+  {
+    number: 37,
+    slug: 'matthew-green',
+    name: 'Matthew D. Green',
+    title: 'The Cryptography Auditor',
+    knownFor: 'TrueCrypt audit, and explaining broken crypto in public',
+    rarity: 'epic',
+    impact: 86,
+    technical: 92,
+    defense: 88,
+    research: 93,
+    influence: 89,
+    nationality: 'USA',
+    era: '2010–present',
+    domains: ['Applied cryptography', 'Protocol analysis', 'Public explanation'],
+    scouting:
+      'Johns Hopkins cryptographer who co-led the Open Crypto Audit Project’s review of TrueCrypt, contributed to the analysis of Dual_EC_DRBG and the RSA BSAFE backdoor, and worked on the attacks behind Logjam and DROWN. His blog is the standard place the rest of the industry goes to find out how badly a new crypto story is being reported.',
+    note: 'Does the audit, then does the translation so the rest of us can follow it.',
+    status: 'locked',
+    sources: [
+      { label: 'Matthew D. Green', url: 'https://en.wikipedia.org/wiki/Matthew_D._Green' },
+      { label: 'A Few Thoughts on Cryptographic Engineering', url: 'https://blog.cryptographyengineering.com/' },
+    ],
+  },
+  {
+    number: 38,
+    slug: 'j-alex-halderman',
+    name: 'J. Alex Halderman',
+    title: 'The Voting Machine Auditor',
+    knownFor: 'Cold boot attacks, election security, and Let’s Encrypt',
+    rarity: 'epic',
+    impact: 87,
+    technical: 93,
+    defense: 92,
+    research: 95,
+    influence: 89,
+    nationality: 'USA',
+    era: '2008–present',
+    domains: ['Election security', 'Measurement', 'PKI'],
+    scouting:
+      'Co-authored the cold boot attack paper showing DRAM retains keys after power off, then spent a career demonstrating — in court and in front of legislatures — that deployed voting machines could be reprogrammed. Co-founded the Internet Security Research Group behind Let’s Encrypt, and co-authored the ZMap internet-wide scanner and the Logjam and FREAK results.',
+    note: 'Let’s Encrypt alone changed the default state of the web from plaintext to TLS.',
+    status: 'locked',
+    sources: [
+      { label: 'J. Alex Halderman', url: 'https://en.wikipedia.org/wiki/J._Alex_Halderman' },
+      { label: 'Lest We Remember: Cold Boot Attacks on Encryption Keys', url: 'https://citp.princeton.edu/our-work/memory/' },
+    ],
+  },
+  {
+    number: 39,
+    slug: 'nadia-heninger',
+    name: 'Nadia Heninger',
+    title: 'The Key-Entropy Auditor',
+    knownFor: 'Mining Your Ps and Qs, Logjam, and measuring real deployed crypto',
+    rarity: 'epic',
+    impact: 85,
+    technical: 95,
+    defense: 88,
+    research: 96,
+    influence: 87,
+    nationality: 'USA',
+    era: '2012–present',
+    domains: ['Cryptanalysis', 'Internet measurement', 'Key generation'],
+    scouting:
+      'Co-authored “Mining Your Ps and Qs”, which scanned the whole IPv4 internet and found that a meaningful share of TLS and SSH keys shared factors because embedded devices generated them without entropy — and then factored them. Followed it with Logjam, DROWN and FREAK, a body of work whose method is: measure what is actually deployed, then break the weak part.',
+    note: 'Proved the crypto was fine and the random number generators were not.',
+    status: 'locked',
+    sources: [
+      { label: 'Nadia Heninger', url: 'https://en.wikipedia.org/wiki/Nadia_Heninger' },
+      { label: 'Mining Your Ps and Qs (USENIX Security 2012)', url: 'https://factorable.net/paper.html' },
+    ],
+  },
+  {
+    number: 40,
+    slug: 'troy-hunt',
+    name: 'Troy Hunt',
+    title: 'Keeper of Have I Been Pwned',
+    knownFor: 'Turning breach data into a public service',
+    rarity: 'rare',
+    impact: 84,
+    technical: 85,
+    defense: 94,
+    research: 80,
+    influence: 90,
+    nationality: 'Australia',
+    era: '2013–present',
+    domains: ['Breach data', 'Password security', 'Public awareness'],
+    scouting:
+      'Built Have I Been Pwned in 2013 as a way for ordinary people to find out whether their account was in a dump, and it became infrastructure: browsers, password managers and the NIST-endorsed practice of checking passwords against known-breached lists all query it, using a k-anonymity scheme that never sends the password. Runs it as a public good rather than a product.',
+    note: 'One person’s side project ended up inside the login flow of half the web.',
+    status: 'locked',
+    sources: [
+      { label: 'Troy Hunt', url: 'https://en.wikipedia.org/wiki/Troy_Hunt' },
+      { label: 'Have I Been Pwned', url: 'https://haveibeenpwned.com/' },
+    ],
+  },
+  {
+    number: 41,
+    slug: 'window-snyder',
+    name: 'Window Snyder',
+    title: 'The Serial Security Chief',
+    knownFor: 'Windows XP SP2, Firefox, Apple, Intel, and Threat Modeling',
+    rarity: 'legendary',
+    impact: 89,
+    technical: 88,
+    defense: 96,
+    research: 82,
+    influence: 92,
+    nationality: 'USA',
+    era: '2002–present',
+    domains: ['Product security', 'Threat modelling', 'Device security'],
+    scouting:
+      'Was security lead and signoff for Windows XP Service Pack 2 and Windows Server 2003, co-wrote the Threat Modeling book that came out of that era, then ran security at Mozilla for Firefox, at Apple on privacy and security strategy, at Fastly and Square, and became Intel’s first chief software security officer. Founded Thistle Technologies in 2020 to bring update infrastructure to embedded devices.',
+    note: 'Has been the person accountable for a shipping product’s security more times than anyone.',
+    status: 'locked',
+    sources: [
+      { label: 'Window Snyder', url: 'https://en.wikipedia.org/wiki/Window_Snyder' },
+      { label: 'Thistle Technologies', url: 'https://thistle.tech/' },
+    ],
+  },
+  {
+    number: 42,
+    slug: 'heather-adkins',
+    name: 'Heather Adkins',
+    title: 'Google’s Founding Defender',
+    knownFor: 'Twenty-plus years of Google security, and Operation Aurora',
+    rarity: 'rare',
+    impact: 85,
+    technical: 88,
+    defense: 96,
+    research: 80,
+    influence: 88,
+    nationality: 'USA',
+    era: '2002–present',
+    domains: ['Incident response', 'Enterprise defence', 'Reliability'],
+    scouting:
+      'A founding member of Google’s security team who built and ran its incident response function, including the response to the 2009 Operation Aurora intrusion that Google chose to disclose publicly — a decision that reset industry norms on breach transparency. Co-authored Building Secure and Reliable Systems, and has served on US federal cybersecurity advisory bodies.',
+    note: 'Ran the response that made public disclosure of a state intrusion normal.',
+    status: 'locked',
+    sources: [
+      { label: 'Building Secure and Reliable Systems', url: 'https://sre.google/books/building-secure-reliable-systems/' },
+      { label: 'Operation Aurora', url: 'https://en.wikipedia.org/wiki/Operation_Aurora' },
+    ],
+  },
+  {
+    number: 43,
+    slug: 'parisa-tabriz',
+    name: 'Parisa Tabriz',
+    title: 'Google’s Security Princess',
+    knownFor: 'Chrome security, and the campaign that made HTTPS the default',
+    rarity: 'rare',
+    impact: 86,
+    technical: 89,
+    defense: 95,
+    research: 84,
+    influence: 90,
+    nationality: 'USA',
+    era: '2007–present',
+    domains: ['Browser security', 'HTTPS adoption', 'Security engineering'],
+    scouting:
+      'Joined Google as a penetration tester, printed “Security Princess” on her business card, and rose to run Chrome. Led the multi-year project to mark plain HTTP as “Not secure” in the world’s most-used browser, which more than anything else moved the web to encryption by default, and pushed Project Zero’s 90-day disclosure deadline as an industry-wide forcing function.',
+    note: 'Changed one string in a browser UI and moved the whole web to TLS.',
+    status: 'locked',
+    sources: [
+      { label: 'Parisa Tabriz', url: 'https://en.wikipedia.org/wiki/Parisa_Tabriz' },
+      { label: 'Chromium: marking HTTP as not secure', url: 'https://blog.chromium.org/2018/02/a-secure-web-is-here-to-stay.html' },
+    ],
+  },
+  {
+    number: 44,
+    slug: 'alex-stamos',
+    name: 'Alex Stamos',
+    title: 'The CSO Who Resigned Over It',
+    knownFor: 'Yahoo, Facebook, and saying the uncomfortable thing in public',
+    rarity: 'rare',
+    impact: 85,
+    technical: 88,
+    defense: 92,
+    research: 84,
+    influence: 90,
+    nationality: 'USA',
+    era: '2004–present',
+    domains: ['Enterprise security', 'Platform abuse', 'Disinformation'],
+    scouting:
+      'Was CISO at Yahoo, where he objected to a government email-scanning programme, then CSO at Facebook through the investigation into foreign influence operations, leaving in 2018 over how much the company would disclose. Publicly challenged the NSA director on encryption backdoors, founded the Stanford Internet Observatory, and co-founded iSEC Partners and later Krebs Stamos Group.',
+    note: 'The card about what the job costs when you do it honestly.',
+    status: 'locked',
+    sources: [
+      { label: 'Alex Stamos', url: 'https://en.wikipedia.org/wiki/Alex_Stamos' },
+      { label: 'Stanford Internet Observatory', url: 'https://cyber.fsi.stanford.edu/io' },
+    ],
+  },
+  {
+    number: 45,
+    slug: 'dan-geer',
+    name: 'Dan Geer',
+    title: 'The Field’s Dissenting Economist',
+    knownFor: 'CyberInsecurity: The Cost of Monopoly, and getting fired for it',
+    rarity: 'legendary',
+    impact: 88,
+    technical: 88,
+    defense: 90,
+    research: 92,
+    influence: 93,
+    nationality: 'USA',
+    era: '1998–present',
+    domains: ['Security economics', 'Risk management', 'Policy'],
+    scouting:
+      'Co-authored the 2003 CCIA report arguing that monoculture in operating systems was itself a national security risk, and was fired by @stake, then a Microsoft consultancy, the day it was published. Went on to serve as chief information security officer of In-Q-Tel and to give a run of Black Hat and USENIX keynotes that are still the most quoted long-form arguments about security policy the field has produced.',
+    note: 'Paid for the paper with his job, and the paper was right.',
+    status: 'locked',
+    sources: [
+      { label: 'Dan Geer', url: 'https://en.wikipedia.org/wiki/Dan_Geer' },
+      { label: 'CyberInsecurity: The Cost of Monopoly (2003)', url: 'https://www.schneier.com/essays/archives/2003/09/cyberinsecurity_the.html' },
+    ],
+  },
+  {
+    number: 46,
+    slug: 'kevin-mandia',
+    name: 'Kevin Mandia',
+    title: 'The Incident Response Industry',
+    knownFor: 'Mandiant, and the APT1 report that named the unit',
+    rarity: 'legendary',
+    impact: 88,
+    technical: 86,
+    defense: 96,
+    research: 86,
+    influence: 92,
+    nationality: 'USA',
+    era: '2004–present',
+    domains: ['Incident response', 'Threat attribution', 'Forensics'],
+    scouting:
+      'Founded Mandiant in 2004 and built breach response into a business that governments and Fortune 100 boards call at 2am. In 2013 the company published APT1, a report attributing years of intrusions to a specific People’s Liberation Army unit with building photographs and operator handles — the moment public, named attribution became something private companies did.',
+    note: 'Made attribution a commercial deliverable instead of a classified one.',
+    status: 'locked',
+    sources: [
+      { label: 'Mandiant', url: 'https://en.wikipedia.org/wiki/Mandiant' },
+      { label: 'APT1: Exposing One of China’s Cyber Espionage Units (2013)', url: 'https://www.mandiant.com/resources/reports/apt1-exposing-one-chinas-cyber-espionage-units' },
+    ],
+  },
+  {
+    number: 47,
+    slug: 'mikko-hypponen',
+    name: 'Mikko Hyppönen',
+    title: 'The Malware Historian',
+    knownFor: 'Three decades at F-Secure, and finding the authors of Brain',
+    rarity: 'legendary',
+    impact: 87,
+    technical: 88,
+    defense: 94,
+    research: 88,
+    influence: 92,
+    nationality: 'Finland',
+    era: '1991–present',
+    domains: ['Malware analysis', 'Threat research', 'Public communication'],
+    scouting:
+      'Has been analysing malware at F-Secure since 1991, through the DOS virus era, Sasser and Blaster, Stuxnet and modern ransomware. Tracked down and interviewed the Pakistani brothers who wrote Brain, the first PC virus, twenty years after the fact. Formulated Hyppönen’s law — if it is smart, it is vulnerable — and is the researcher most often trusted to explain a live incident to the public.',
+    note: 'The continuity card. One person watched the entire history of malware happen.',
+    status: 'locked',
+    sources: [
+      { label: 'Mikko Hyppönen', url: 'https://en.wikipedia.org/wiki/Mikko_Hypp%C3%B6nen' },
+      { label: 'Brain (computer virus)', url: 'https://en.wikipedia.org/wiki/Brain_(computer_virus)' },
+    ],
+  },
+  {
+    number: 48,
+    slug: 'robert-m-lee',
+    name: 'Robert M. Lee',
+    title: 'The Industrial Control Defender',
+    knownFor: 'Dragos, and the analysis of the Ukraine grid attacks',
+    rarity: 'rare',
+    impact: 83,
+    technical: 90,
+    defense: 95,
+    research: 90,
+    influence: 85,
+    nationality: 'USA',
+    era: '2013–present',
+    domains: ['ICS/OT security', 'Threat intelligence', 'Incident response'],
+    scouting:
+      'A former US Air Force cyber warfare officer who co-authored the analysis of the 2015 Ukrainian power grid attack and the later CRASHOVERRIDE and TRISIS malware, then founded Dragos to do industrial control system defence as a specialism rather than an IT afterthought. Co-wrote the SANS ICS courses that most OT defenders come through.',
+    note: 'The set’s reminder that some networks fail into a physical consequence.',
+    status: 'locked',
+    sources: [
+      { label: 'Robert M. Lee — Dragos', url: 'https://www.dragos.com/leadership/robert-m-lee/' },
+      { label: 'Analysis of the Cyber Attack on the Ukrainian Power Grid (SANS/E-ISAC, 2016)', url: 'https://www.nerc.com/pa/CI/ESISAC/Documents/E-ISAC_SANS_Ukraine_DUC_18Mar2016.pdf' },
+    ],
+  },
+  {
+    number: 49,
+    slug: 'lesley-carhart',
+    name: 'Lesley Carhart',
+    handle: 'hacks4pancakes',
+    title: 'The Industrial Incident Responder',
+    knownFor: 'OT forensics, and teaching the field how to get into the field',
+    rarity: 'rare',
+    impact: 81,
+    technical: 89,
+    defense: 94,
+    research: 82,
+    influence: 86,
+    nationality: 'USA',
+    era: '2010–present',
+    domains: ['Digital forensics', 'ICS/OT security', 'Mentorship'],
+    scouting:
+      'Led incident response at Motorola Solutions and then at Dragos, running investigations inside live industrial networks where you cannot simply reimage the plant. Writes long-running public guidance on breaking into and surviving the profession, founded PancakesCon, and holds the SANS Lifetime Achievement Award for that work as much as the casework.',
+    note: 'The mentorship is the contribution. Half a conference floor learned from those posts.',
+    status: 'locked',
+    sources: [
+      { label: 'Lesley Carhart', url: 'https://en.wikipedia.org/wiki/Lesley_Carhart' },
+      { label: 'Lesley Carhart’s blog', url: 'https://tisiphone.net/about/' },
+    ],
+  },
+  {
+    number: 50,
+    slug: 'katie-nickels',
+    name: 'Katie Nickels',
+    title: 'The ATT&CK Translator',
+    knownFor: 'MITRE ATT&CK threat intelligence, and making CTI actionable',
+    rarity: 'rare',
+    impact: 82,
+    technical: 84,
+    defense: 94,
+    research: 86,
+    influence: 88,
+    nationality: 'USA',
+    era: '2015–present',
+    domains: ['Threat intelligence', 'Detection engineering', 'ATT&CK'],
+    scouting:
+      'Was the threat intelligence lead for MITRE ATT&CK during the years it became the shared vocabulary defenders use to describe adversary behaviour, then went to Red Canary as director of intelligence. Teaches the SANS cyber threat intelligence course and spends most of her public work on the unglamorous question of how an intelligence report turns into a detection someone actually deploys.',
+    note: 'ATT&CK gave the blue team a language. This is the card for the person who taught it.',
+    status: 'locked',
+    sources: [
+      { label: 'MITRE ATT&CK', url: 'https://attack.mitre.org/' },
+      { label: 'Katie Nickels — SANS Institute', url: 'https://www.sans.org/profiles/katie-nickels/' },
+      { label: 'Katie Nickels — Red Canary', url: 'https://redcanary.com/authors/katie-nickels/' },
+    ],
+  },
+];
+
+export const totalPlanned = 50;
+
+export const lockedCount = pros.filter((p) => p.status === 'locked').length;
+export const draftedCount = pros.filter((p) => p.status !== 'candidate').length;
+export const illustratedCount = pros.filter((p) => Boolean(p.front)).length;
+
+export const featuredPros = pros.filter((p) => p.status === 'locked').slice(0, 6);
+
+export function getPro(slug: string) {
+  return pros.find((p) => p.slug === slug);
+}
diff --git a/src/data/site.ts b/src/data/site.ts
index 52d88d4..a177325 100644
--- a/src/data/site.ts
+++ b/src/data/site.ts
@@ -14,6 +14,7 @@ export const site = {
 export const nav = [
   { label: "Series One", href: "/cards" },
   { label: "Hacking Legends", href: "/hacking-legends" },
+  { label: "Security Pros", href: "/security-professionals" },
   { label: "Collect", href: "/collect" },
   { label: "Contribute", href: "/contribute" },
 ] as const;