Based in Vietnam. Mostly just reading source code all day and breaking stuff to see what falls apart. Got lucky digging through django-unicorn — found a state manipulation bug that turned into CVE-2026-31815.

When not hunting bugs, I'm throwing patches at whatever catches my eye on GitHub.

🎯 Attack Surface:

• 🔓 Vuln Research — source auditing, logic bug hunting
• 🛠️ OSS Patches — langchain, ray, sktime, tldr-pages, ...
• 🧪 Tooling — custom audit scripts, automated scanners
• 🐍 Stack — Python, Go, JS/TS, Bash

stuff that got merged, stuff still cooking

Target	Operation	Status
langchain	🔧 Fix tool_outputs validation mismatch in core
ray	📦 Patch axios dependency in dashboard
sktime	🐛 Fix F1 score division by zero in ClaSP
aibrix	🧹 Deduplicate session affinity header constants
stella	🧪 Add unit tests for array normalizers & color helpers
django-unicorn	💀 CVE-2026-31815 — State manipulation flaw

▸ netstat -an | grep ESTABLISHED

┌──────────────────────────────────────────────────────────────┐
│  "The quieter you become, the more you are able to hear."   │
│                                          — Kali Linux       │
└──────────────────────────────────────────────────────────────┘