About
I read code, find where a trust boundary breaks, and prove the bug against the real running software before I disclose it.
Most of what I find sits in developer tooling. MCP servers, editor plugins, self-hosted apps, browser extensions. The pattern that repeats is untrusted synced content, or an open local port, reaching something it was never meant to.
Everything gets a working proof-of-concept and a coordinated report. A clean audit with no finding is a legitimate result too, and I report it that way.
14CVEs assigned
2advisories awaiting CVE
7certifications
CVEs
WolfStack9.8 Critical
A cluster-authentication secret is hard-coded into every build and published, so any unauthenticated client reaches full remote code execution.
Tugtainer8.1 High
OIDC id_tokens are decoded without checking signature, audience or expiry, so a forged token mints a fully authenticated session with container and host control.
PasteGuard7.6 High
The LLM-proxy routes carry no CORS or CSRF guard and fall back to the server-side API key, so any visited site drives billed requests through the user's own provider account.
crw7.5 High
The JS-rendering tiers follow redirects inside the browser stack without re-checking the URL allowlist, so an external open redirect reaches internal addresses and the response is returned.
code-graph-rag7.1 High
The structural-search tools resolve symlinks with no containment check, so a symlink planted in an analyzed repo reads and overwrites files outside the project root.
Note Toolbar (Obsidian)7.0 High
A toolbar item that displays a frontmatter property runs it as JavaScript if the value contains a script payload, turning a "show this property" button into code execution on note open.
emlog6.8 Medium
The AI-assistant exec endpoint has no CSRF protection, so a visited page can drive SQL execution and take over an admin account.
Terrapod6.5 Medium
The GPG-key API is gated on "authenticated" but not "admin," so any user can add or delete keys in the platform-wide provider-signature trust store.
Supernote (Obsidian)5.6 Medium
The device-supplied uri field is never checked for ".." before the vault write, so a malicious or spoofed Supernote device writes files outside the vault on sync.
Gortex5.5 Medium
The indexer walk does not skip symlinked files, so a .go-named symlink in a scanned repo is indexed and its out-of-repo target is returned by search_text.
ZotLit5.5 Medium
An attachment's path is trusted verbatim on import, so a poisoned Zotero library copies arbitrary local files (for example ~/.ssh/id_rsa) into the vault.
inference-gateway5.4 Medium
The proxy routes strip the caller's key and inject the operator's own, with no CORS or CSRF guard, so a cross-origin request drives billed completions through the operator's account.
linux-entra-sso5.3 Medium
The SSO-URL check is an unanchored startsWith(), so login.microsoftonline.com.attacker.tld passes it and receives the victim's Entra PRT SSO cookie.
OpenLore4.7 Medium
The LLM-derived domain field is not validated before it is used in an output path, so a prompt-injected repo steers spec generation to write a file outside the project.
The twelve records assigned in September 2026 are propagating to cve.org and NVD.
Published Advisories
A CVE has been requested for each and is pending assignment. Further findings are in coordinated disclosure via VulnCheck.
Certifications
Contact