I research security issues, contribute fixes to open-source projects, and build tools for the systems I use. My work sits at the intersection of cybersecurity, AI, and cloud computing; outside of it, I love 房东的猫, trains, and aviation.
Read my security research · Explore merged PRs · Visit my blog
CVE-2026-78847 · Code execution in gray-matter's JavaScript front matter. I independently reproduced the issue, verified mitigations, and requested a CVE for the library. An earlier upstream PR had already documented it; finder credit on the published record is pending. Investigation →
Selected fixes merged upstream, with the PRs behind them:
| Project | Merged fix |
|---|---|
| Keycloak | Fixed a Base64URL padding crash. |
| Dify | Replaced db.paginate with SQLAlchemy pagination. |
| LocalSend | Corrected WebRTC failure handling. |
| browser-use | Restored remote-download callbacks. |
| Composio | Fixed a trigger shutdown deadlock. |
| yuque-dl | Added a download-all-books command. |
- CodexQuota · macOS menu-bar monitor for AI coding subscriptions
- DeDeBayer · interactive demosaicing visualizer · Live demo →
- llm-from-scratch · a tiny GPT trained with MLX on Apple Silicon
- PR Dashboard · tracking open-source contributions · Live dashboard →
Work
Tools
Off the clock
🌐 Home · ✍️ Blog · 📚 Docs · 💬 Telegram