Research

Security research, with the evidence attached.

Technical investigations, vulnerability research, and notes on what the work established, and what it did not.

Public findings

Read the disclosed work in full.

Public write-ups with affected code paths, impact context, reproduction details, and remediation notes where disclosure terms allow.

Disclosures: 48
CVE IDs: 22
Projects: 25

View public findings

ResearchOct 7, 2026

Cyber guardrails tax the defender, not the attacker

Hugging Face had to fall back on an open-weight model to investigate an AI-run intrusion after Claude refused. That isn't a one-off. The way labs build cyber safeguards, the cost lands on defenders who need proof, not attackers who don't.

Mufeed VH14 min read

Research archive

05 entries

ResearchSep 10, 2026

A Lean Use-After-Free That ‘Proves’ 1 + 1 = 3

A compiler/runtime boundary bug let safe Lean code produce a native use-after-free. We trace Winfunc's discovery, the memory ownership failure, and how a corrupted native_decide result became an explicit assumption in a theorem claiming 1 + 1 = 3.

Mufeed VH14 min read

ResearchJul 23, 2026

Finding six NGINX vulnerabilities with open models

We used GLM-5.1 and GLM-5.2 to scan NGINX. The scan produced six security findings with five CVE identifiers. This report describes the affected code, analysis traces, and proof conditions.

Mufeed VH16 min read

ResearchApr 18, 2026

Hacking the old HackerNews codebase

Auditing the old HackerNews codebase for security vulnerabilities with LLMs on a specialized harness.

Mufeed VH11 min read

ResearchMar 26, 2026

What an automated vulnerability research system actually found

Thirteen patched bugs across nine projects, including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth. What the system got right, where it still falls over, and why executable PoCs matter more than model reasoning.

Mufeed VH8 min read

ResearchAug 30, 2024

How Asterisk Works

A repost of the original Asterisk architecture: how an AI security agent indexed code, generated attack ideas, verified vulnerabilities, and produced patches with low-noise reports.

Mufeed VH9 min read

Start with one repository

Bring us your hardest codebase.
We'll bring the proof.

Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.

Latest research