Finding real bugs, and proving they're real

Silent claim-verification bypass in PyJWT CVE-2026-103001 · CVSS 6.5 · published

PyJWT.decode() mutated the caller's options dict in place, so a dict reused across calls could silently drop claim verification on the second use — a regression of a previously-fixed issue (#679). An authentication-library bug with no crash and no error: exactly the silent-integrity class. Reported through the private advisory channel, fixed upstream, CVE assigned and published, credit accepted.

Use-after-free & double-free in a config-management core T4 · merged

A missing return after a free let execution fall through into a read of the freed object, then a second free. Found by reading the control flow, reproduced, fixed with the one-line early return, and verified red→green.

Authorization-boundary hardening for org-scoped secrets merged

A secret query matched org membership on org_id alone without checking repo_id = 0. I stated the risk precisely — not exploitable on a normally-run instance, because no activation path yields the required state — and shipped the defensive fix with isolation tests. Saying exactly how far a bug does and doesn't reach is the job.

Memory-safety hardening in a UPnP daemon's native rule builders T4 · merged

Unchecked calloc()/malloc() results in netfilter rule construction, plus a netlink socket left out of sync on a cache-refresh error. Low-level C on LAN-reachable input, fixed and verified at the sites that run.

Silent GPU out-of-bounds in 4-bit quantization T4 · filed (open)

A floor-division under-allocated the packed buffer for wide quant-storage dtypes, so the GPU wrote one byte past the end — invisible, because the default dtype makes the formula exactly right and the allocator's padding absorbs the overflow until caching is disabled. I measured the blast radius (never more than 7 bytes; a neighbour tensor survived 800 trials) rather than assuming it, and filed public fixes per the project's own security guide, which classes this as correctness, not a vulnerability. Both still open — reported honestly as filed, not merged.

Finite gradients at a singular point merged

Numerical integrity treated as a correctness property: solve_cubic produced non-finite gradients at its acos boundary. Guarded both branches so the backward pass stays finite — the kind of silent wrong-answer bug that never crashes and never logs.

Unsafe deserialization → remote code execution coordinated disclosure in progress

A neuromorphic library's public, documented model-loading API called torch.load(…, weights_only=False) on a caller-supplied path with no validation — loading any untrusted .pt file runs arbitrary code. Reported through the project's private security-advisory channel, currently in triage. Details, target, and identifiers withheld until the maintainer publishes. Found as an earlier static-only report that had never been executed; I ran the PoC against the real, unmodified function before reporting — a lead isn't a finding until it reproduces.

In one audit pass I ran ~1,100 configurations of differential and invariant oracles across an ML stack — optimizers, metrics vs a reference implementation, adapter round-trips, kernel sanitizer sweeps, compiler-vs-eager, ODE solvers, quantization. Result: clean. One lead survived to T2 (a compiler reduction inexact on identical values) and I didn't file it, because it reproduces only in a harness and overlaps work already open upstream.

A well-measured "this isn't a bug," and a lead left unfiled because it didn't clear the bar, is principal-level judgment — and the honest counterweight to a list of wins. Negatives get reported the same way positives do.