I used to do quite a lot of security code review in VS Code. Its debugger is still superior, but I switched to Zed because it is lighter and, with AI tools such as Codex and Claude Code, I spend le...

Ferron’s request handling contains a mismatch between how it matches URL locations and how Windows interprets file paths. With the backslash rejection setting disabled, a request can miss a locatio...

Two vulnerabilities in rv, and bypasses for both fixes On April 3, 2026 I reported two vulnerabilities in rv, a Rust-based Ruby version manager and gem installer from Spinel Coop, through GitHub’s...

I reported an issue in Go html/template where interpolating untrusted input into iframe srcdoc can still lead to XSS. The short version is that html/template applies normal HTML attribute escaping...

I found and reported this issue in drizzle-orm Gel dialect: GHSA-8wc6-7472-j32f GelDialect.escapeName() missing quote-doubling allows SQL injection This is same bug class as CVE-2026-39356 ...

I found these issues with the help of AI while reviewing uv wheel install/uninstall flows. I contacted the maintainers about these findings two months ago (March 2026). This post covers two relat...

I found these issues with the help of AI while reviewing Bun.SQL transaction handling. I found two SQL injection vulnerabilities in Bun.SQL transaction APIs. The issues are: tx.savepoint(call...

CocoaPods contains an unsafe executable resolution issue in Pod::Executable that may allow arbitrary command execution when running CocoaPods commands inside a directory containing attacker-control...

Recently while fuzzing Node.js modules I found an issue which causes the process to abort when malformed Windows UNC style paths are passed into pathToFileURL(). This was initially something I look...

So I decided to fuzz Microvium. If you haven’t heard of it, Microvium is this tiny JavaScript engine designed for embedded systems like IoT devices, microcontrollers, stuff where you’ve got maybe 1...