DEF CON 34 · United States · 2026
Source-published 15-pixel touch SAO firmware project; physical artifact and handoff unverified
Punk Security's public repository calls its Arduino sketch "the firmware for the OWASP DefCon 34 SAO." Its final public source snapshot provides an actual `main.ino` rather than an event-labelled name alone: it defines 15 addressable RGB pixel positions, three PTC capacitive-touch nodes, and a README that says the SAO header exposes UPDI for reprogramming. This clears the catalogue threshold for a named, source-published pre-event electronic add-on project. It does not establish a final PCB, microcontroller, power path, exact SAO specification, fabricated unit, approved OWASP or DEF CON relationship, price, allocation, pickup, delivered handoff, credential function, or reusable image rights.
People
This is the named public GitHub repository publisher. It does not establish a particular person's identity, sole hardware or firmware authorship, OWASP or DEF CON affiliation, a physical artifact, event authorization, or image-reuse permission.
SourceThe final public commit carries this author name. It identifies a source-commit role only and does not establish a real-world identity, sole authorship, hardware manufacture, event affiliation, delivery, or image-reuse permission.
SourceIt captures a newly published DEF CON 34 source trail while preserving the distinction between a real firmware project and a verified event artifact. The committed code is unusually specific about a 15-pixel interaction surface and three touch nodes, but it contains no board design, release, inventory, or organizer confirmation. Keeping those two facts together makes the record useful without converting public source code into an assertion of hardware delivery or official OWASP sponsorship.
The commit-pinned sketch defines `NUM_LEDS = 15`, an addressable-pixel data output on PB3, LED-power control on PB2, and three PTC touch nodes on PA4, PA5, and PA6; its own comment calls those the original badge's three PTC nodes. The public material does not identify the microcontroller part, LED part/package/layout, touch-electrode geometry, PCB, schematic, BOM, SAO version/pinout/orientation, voltage/current limits, battery or power source, protection, enclosure, board revision, assembly, production, electrical test, host test, safety outcome, or final physical-unit parity.
The public Arduino sketch uses `tinyNeoPixel_Static` and the PTC library for a touch-driven LED-animation surface, while the README credits MegaTinyCore as a firmware foundation and says UPDI is exposed on the SAO header for reprogramming. It is a source snapshot, not a tagged event firmware release: no build configuration, binary, source-to-unit mapping, supported reprogramming workflow, recovery path, security review, privacy statement, support policy, or explicit repository licence was recovered. This catalogue links the source but does not reproduce pin assignments, touch thresholds, animation controls, or programming instructions.
The repository's public commits date to August 3, 2026, immediately before DEF CON 34. Its README uses the exact OWASP DefCon 34 SAO name, and the final commit carries the public author name SimonGurney under the Punk Security repository. Those are source-publisher statements only: no reviewed OWASP, DEF CON, BadgeLife, village, marketplace, or delivery source confirms an authorized relationship, physical run, availability, attendee handoff, or admission role.
Source-backed hardware metadata
Structured technical signals seeded from public badge documentation, repositories, schematics, firmware notes, or event evidence. These fields are designed for filtering, API use, repair planning, preservation, and future Companion Gear matching.
Punk Security's public README calls its Arduino sketch firmware for the OWASP DefCon 34 SAO. This classifies a named, source-published electronic add-on project, not a confirmed physical unit, official OWASP or DEF CON artifact, delivered attendee item, or credential.
Signal sourceThe commit-pinned README calls the project an SAO and says UPDI is exposed on its SAO header. It does not identify a header version, pinout, orientation, power/data wiring, voltage/current limits, protection, host compatibility, or safe connection result.
Signal sourceThe commit-pinned Arduino sketch defines 15 addressable RGB pixel positions and uses a tinyNeoPixel surface. It does not identify final LED part/package/layout, power budget, brightness/current behavior, installed firmware, or physical-unit parity.
Signal sourceThe public `.ino` source uses Arduino APIs, while the README credits MegaTinyCore. This records a source-published firmware surface, not a tagged release, reproducible event build, supported reprogramming workflow, or installed-unit state.
Signal sourceRepair, preservation, and legal lab context
Parts, tools, and supplies that match this badge's documented hardware, protocols, or preservation needs. These are category-level recommendations, not compatibility guarantees.
Headers and connector supplies for SAO repair, add-on testing, and preservation.
This badge has a documented SAO connector. Matched technical signals: SAO.
Vendor link · selected for technical relevance
I2C adapter supplies for badge add-ons, sensors, and lab documentation.
SAO workflows often use I2C-compatible add-on testing and bench documentation. Matched technical signals: SAO.
Vendor link · selected for technical relevance
Extension wiring and jumper supplies for testing or displaying SAO add-ons away from the main badge.
Extension wiring is useful for testing and displaying SAO add-ons. Matched technical signals: SAO.
Vendor link · selected for technical relevance
Anti-static bags and storage supplies for preserving loose badge PCBs and sensitive components.
This is documented as an electronic or hardware artifact where anti-static storage can support preservation. Matched technical signals: Electronic badge.
Vendor link · selected for technical relevance
Lifecycle
The `.ino` source uses Arduino APIs and the README credits MegaTinyCore as a foundation. It establishes a published firmware lineage, not an exact MCU selection, tagged event release, reproducible build, source-to-unit mapping, open-source licence, support commitment, or permission to reuse the source.
SourceThe public Arduino sketch defines 15 addressable RGB pixel positions and comments that the original badge has three PTC touch nodes; it changes its visual mode through the source's touch-handling path. This records a code-level interaction surface, not exact LEDs or electrodes, tested hardware, final installed behavior, or a safe operating procedure.
SourceThe README says UPDI is exposed on the SAO header for reprogramming. It does not provide or establish a pinout, voltage levels, programmer compatibility, access-control policy, safe procedure, supported recovery path, final-board implementation, or successful event-unit result.
SourceOperational history
The exact public event label remains discoverable without turning it into evidence of OWASP or DEF CON endorsement, a physical run, availability, a completed delivery, or a credential.
The public code is linked as evidence without being presented as licensed, supported, reproducible, safe to reprogram, or equivalent to a delivered event firmware image.
The United States record remains source-backed and image-free rather than copying source-page media, documentation screenshots, event photos, social media, placeholders, or generated approximations.
The catalogue records the actual firmware trail without treating source pins or library use as a finished, safe, fabricated, standard-compliant, or plug-and-play add-on.