Research

Research and disclosures.

Technical writing from the lab.

Disclosures·Feb 3, 2026·8 min read

The Recent CVEs in React and Node.js Were Found by an AI

Two upstream CVEs, one in Node.js and one in React, came out of the same automated research loop. The real story is less magical and more useful: what the system actually did, where it guessed, and why verified AI bug hunting now matters.

Engineering·9 min read

How Asterisk Works

[!Imitation is the sincerest form of flattery] This is a repost of the initial architecture of winfunc (previously called Asterisk), as of . Since then we’ve seen several attempts…