Devansh Batham Security Researcher / Builder / Breaker / Lifelong learner.. I got pulled into security sometime around 2016. I don't remember exactly how...
I actually wanted to write about this for months now, but it has been difficult, because the space was moving too fast, that it was impossible to catch up on the progress happening, almost unreal. Every few weeks the topic changed because the models changed. But, anyway, now I think the direction is pretty clear. LLMs have become genuinely exceptional for vulnerability research, and when I say…
Table of Contents Intro Lore What is Harden-Runner's Egress Policy? Egress Block Policy Bypass via DNS over TCP Proof of Concept Egress Policy Bypass via DNS over HTTPS — Proxying DNS queries using Google's resolver Proof of Concept Disclosure Timeline Update: Since the publication of this research, the identified issues have been officially addressed in Harden Runner version 2.16.0 . The…
Table of Contents Intro Lore Why "Find All The Vulnerabilities" does not work Minimal Scaffolding That Actually Helps Case Study: Claude Opus 4.6 and Firefox What Anthropic Actually Did My Own Methodology The Approach Parse Server HonoJS ElysiaJS harden-runner BullFrog Better-Hub Vulnerabilities Found Why This Worked The Sweet Spot Prompt Injection References Note: Initially, the idea was to write…
Table of Contents Intro Lore What is Parse Server? The readOnlyMasterKey Contract Vulnerabilities CVE-2026-29182 Cloud Hooks and Cloud Jobs bypass readOnlyMasterKey CVE-2026-30228 File Creation and Deletion bypass readOnlyMasterKey CVE-2026-30229 /loginAs allows readOnlyMasterKey to gain full access as any user CVE-2026-30863 JWT Audience Validation Bypass in Google, Apple, and Facebook Adapters…
Table of Contents Intro Lore How BullFrog's Egress Filtering Works The Layer 3/4 Problem Shared Infrastructure is Everywhere Vulnerability Vulnerable Code Proof of Concept Infrastructure Setup The Workflow Real-World Impact Disclosure Timeline References Intro Lore This is the third vulnerability I'm disclosing in BullFrog, alongside a Bypassing egress filtering in BullFrog GitHub Action and a…
Table of Contents What is Better-Hub? The Vulnerabilities 01. Unsanitized README → XSS 02. Issue Description → XSS 03. Stored XSS in PR Bodies 04. Stored XSS in PR Comments 05. Reflected XSS via SVG Image Proxy 06. Large-File XSS (>200 KB) 07. Cache Deception — Private File Access 08. Authz Bypass via Issue Cache 09. Private Repo Prompt Leak 10. GitHub OAuth Token Leaked to Client 11. Open…
Table of Contents Intro Lore What is BullFrog's enable-sudo ? How Sudo is Disabled The Docker Problem Vulnerability Proof of Concept Disclosure Timeline Intro Lore Least privilege is one of those security principles that everyone agrees with and almost nobody fully implements. In the GitHub Actions context, it means your workflow steps should only have the access they actually need, and no more.…
Table of Contents Intro Lore What is BullFrog? How It Works DNS Over TCP Vulnerability Vulnerable Code Proof of Concept Attack Scenario The PoC Script Disclosure Timeline Intro Lore GitHub Actions runners are essentially ephemeral Linux VMs that execute your CI/CD pipelines. The fact that they can reach the internet by default has always been a quiet concern for security-conscious teams — one…
Table of Contents Intro Lore CVE-2026-25598 Bypass using sendto Bypass using sendmsg Bypass using sendmmsg Closing Thoughts Intro Lore GitHub Actions have become a prime vector for supply chain attacks , with attackers exploiting workflow misconfigurations to exfiltrate secrets, deploy malware, or pivot to downstream CI/CD pipelines. Notable incidents, such as the widespread compromise of…
Table of Contents Intro Lore JWT / JWK / JWKS Primer Vulnerabilities [CVE-2026-22817] - JWT middleware "unsafe default" (HS256) Why this becomes an auth bypass Who is affected? Advisory / severity [CVE-2026-22818] - JWK/JWKS middleware header.alg fallback Why it matters Advisory / severity The Fix Fix for #1 (JWT middleware) Fix for #2 (JWK/JWKS middleware) Disclosure Timeline References Intro…