Mufeed VH
Mufeed leads winfunc's product direction and security research, with a focus on turning codebase questions into traceable investigations and reviewable engineering decisions.
Areas of work
- 01Application security
- 02Vulnerability research
- 03Developer tooling
- 04Product strategy
Work in context.
Mufeed VH is co-founder and CEO of winfunc, where he works across product strategy, vulnerability research, and security engineering.
His public work spans AI-assisted software engineering, developer tooling, security utilities, and code analysis. The profiles linked here provide source material for that work.
At winfunc, he focuses on connecting security findings to affected code paths, documenting the evidence and remaining assumptions, and preparing remediation for engineering review.
Follow the source.
These public profiles provide additional work, writing, and project context.
Published by Mufeed.
Research
Cyber guardrails tax the defender, not the attacker
Hugging Face had to fall back on an open-weight model to investigate an AI-run intrusion after Claude refused. That isn't a one-off. The way labs build cyber safeguards, the cost lands on defenders who need proof, not attackers who don't.
Mufeed VH14 min read
Research
A Lean Use-After-Free That ‘Proves’ 1 + 1 = 3
A compiler/runtime boundary bug let safe Lean code produce a native use-after-free. We trace Winfunc's discovery, the memory ownership failure, and how a corrupted native_decide result became an explicit assumption in a theorem claiming 1 + 1 = 3.
Mufeed VH14 min read
Research
Finding six NGINX vulnerabilities with open models
We used GLM-5.1 and GLM-5.2 to scan NGINX. The scan produced six security findings with five CVE identifiers. This report describes the affected code, analysis traces, and proof conditions.
Mufeed VH16 min read
Research
Hacking the old HackerNews codebase
Auditing the old HackerNews codebase for security vulnerabilities with LLMs on a specialized harness.
Mufeed VH11 min read
Research
What an automated vulnerability research system actually found
Thirteen patched bugs across nine projects, including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth. What the system got right, where it still falls over, and why executable PoCs matter more than model reasoning.
Mufeed VH8 min read
Research
How Asterisk Works
A repost of the original Asterisk architecture: how an AI security agent indexed code, generated attack ideas, verified vulnerabilities, and produced patches with low-noise reports.
Mufeed VH9 min read