Projects
Security research and the software I build, kept apart so it is clear which is which.
01
Security Research
Vulnerability research and coordinated disclosure.
CVE-2026-18649: Unbounded Memory Growth
GStreamer RTP Depayloader
A remote, unauthenticated denial of service in GStreamer's H.264 and H.265 RTP depayloaders, where FU-A fragment reassembly had no size limit. Assigned CVE-2026-18649.
CVE-2026-92162: Flatpak System Helper Path Traversal
Flatpak DeployAppstream arch traversal
A path traversal in the Flatpak system helper where an unvalidated arch string in DeployAppstream lets an active local user make the root helper create directories at an arbitrary path, chaining into a local root file write. Assigned CVE-2026-92162 and GHSA-v2gw-v9h5-9q4x.
02
Software
Things I build and ship.
Vonnis
Offline script triage, measured against real corpora
A script triage engine that reads a suspicious PowerShell or shell script and answers, in plain English, whether running it is a bad idea. 111 deterministic YAML detection rules, no API key and no network for the verdict, and a measurement harness that scores the rules against 2,526 real package maintainer scripts and 1,862 Atomic Red Team tests.
TrackMUN
Model UN conference management platform
A full-stack platform for running Model UN conferences end to end: delegate registration, council assignments, QR check-in, and a live press feed. Built with React, Hono on Cloudflare Workers, Turso, and Supabase Auth.