aka ParzivalHack: OSS & AI Security Researcher · IT & Security Consultant
I break parsers responsibly, write about it obsessively, and maintain PySpector, a Rust-core SAST engine built to find the next vulnerability before someone like me does.
triage findings below
finding TB-001 · identity disclosure critical
I started in a SOC at 17 (two months shy of my 18th birthday), watching alerts scroll by and wondering how the bugs behind them got shipped in the first place. Four years later I'm on the other side of that question: finding them in the open-source software everyone depends on (Ansible, psf/black, major AI libraries) and disclosing them properly.
Along the way I co-founded a startup and ran it as CTO to a $500k valuation, wrote for StationX, and built PySpector because the SAST tools I wanted didn't exist. Now I split my time between consulting, AI/LLM security research, and shipping open-source security tooling.
I'm neurodivergent: ADHD and Autism. They're disabilities, no way around that, but in this field they also translate into concrete advantages: pattern recognition, hyperfocus, and an instinct for the edge cases everyone else skims past.
Secured your favorite companies:
Red Hat
U.S. Department of Commerce
Notion
Python Software Foundation
finding TB-002 · remote code execution critical
Real findings in software with billions of downloads, all responsibly disclosed and coordinated with maintainers. Each one rendered the way I actually think about it: source → flow → sink.
A permissive regex in action/main.py
let direct URL references bypass version validation in an Action with 2.2B downloads:
arbitrary code execution on CI runners from just opening a PR. No maintainer interaction. Patched in v26.3.0.
Found and reported a critical, high-impact error-based SQL injection leading to a full database takeover on a US Department of Commerce subdomain. Publicly acknowledged by the agency.
Argument injection in ansible-core leading to remote code execution. Coordinated disclosure with Red Hat's security team, credited in the official advisory.
Identified and responsibly disclosed a critical RCE in a major AI library, surfaced by my own SAST framework during dogfooding. The tool found the bug; I confirmed the exploit.
also on record: a security report to psf/requests (triaged & fixed) · a path-traversal fix in CPython's test suite · active bug bounty targets: LLM sandboxes, CLI coding agents, web-integrated AI pipelines
finding TB-003 · weaponized side project high
A flow-sensitive, inter-procedural taint engine for Python codebases. It builds a project-wide call graph, decomposes every function into a CFG, and propagates taint from sources to sinks with fixed-point iteration, respecting sanitizers along the way. Integrated in SatoriCI's production platform, with a dedicated --ai ruleset for LLM-integrated apps.
finding TB-004 · privilege escalation medium
Traceback (most recent call first):
Web-infrastructure migrations, automated VAPTs, incident prevention & response across client fleets with the ESET suite.
Lead dev of the SAST framework, plus mentor and community moderator since 2022. PySpectorEnterprise in the works.
0 → $500k valuation in 10 months, including a $100k pre-seed I closed myself. Ran 4 business units and 21 people building an AI vocal-helpdesk product. Board member and majority shareholder until a clean exit.
Full MVP lifecycle on contract: hiring, delivery, and the security posture to go with it.
Freelance writer on web pentesting, tooling and OS security; then proposed and co-created their white-papers platform.
AD user management, service desk and Python scripting at national-broadcaster scale.
Where it started: intern → SOC analyst T1/T2 → Cybersecurity Specialist in 10 months (promoted 12 months ahead of plan). SIEM, EDR, live incident response.
finding TB-005 · excessive disclosure low
Everything I've published: CVE writeups, whitepapers, an academic paper and the articles that started it all. New research lands here first.
$ tail -f ~/writeups (next drop: in progress)▊
finding TB-006 · proof of credentials low
finding TB-007 · open port info