Serialize is based on the open-source GCHQ CyberChef project. These docs use upstream concepts and public examples as factual references, then rewrite them around Serialize’s browser workspace, security boundaries, recipe pages, and agent interfaces.
Primary references include the CyberChef README, project wiki, Node API guide, and operation-authoring guide.
Public recipe collections
- mattnotmax/cyberchef-recipes
- kraven-security/CyberChef-recipes
- Neo23x0/cyber-chef-recipes
- SANS Internet Storm Center: CyberChef Base64/XOR
- Gaijin.at CyberChef recipes
These collections provide workflow patterns and analyst use cases. Serialize uses compatible operations, rewritten explanations, and new synthetic inputs rather than redistributing the original investigation artifacts.
Connected services
Most recipes are local-only. Connected recipes are a deliberately small, separately labelled group and currently use only:
- 2D Digital Icons, a Grid Heap-operated, no-key, read-only REST API with explicit CORS support.
- Cloudflare DNS over HTTPS, through Serialize’s existing DNS operation.
Connected recipes are manual, name the destination and transmitted fields, use bounded result sizes, and never embed credentials. “Free” is not treated as “unlimited”; undocumented quotas or third-party terms are not a stable product dependency.
Public teaching material
Course structure and exercises were informed by:
- University of Oviedo — Cryptography Applications
- University Politehnica of Bucharest — Introduction security lab
- Coventry University — Encoding
- UC Santa Cruz Slug Security — reverse-engineering walkthrough
- TryHackMe — CyberChef: The Basics
- NCSC — Secrets teacher pack
Serialize does not reproduce course prose, grading material, restricted downloads, or real malware samples. The lessons extract general learning objectives and rebuild exercises with documentation-only domains, reserved IP ranges, public demonstration keys, and benign byte sequences.
Verification policy
Every installable recipe must:
- Use operations present in the current Serialize catalogue.
- Round-trip through the same URL recipe format used by the workspace.
- Run locally by default; a connected recipe must be manual and disclose its exact network boundary.
- Include a safe sample and an expected result or result shape.
- Explain assumptions, limitations, and security boundaries.
- Avoid embedded credentials, paid-provider calls, unbounded result sets, and silent retries.
The documentation site itself uses Cloudflare Nimbus, an Astro documentation system that publishes human-readable pages alongside Markdown and LLM indexes.