Skip to content
View vinzabe's full-sized avatar
🥷
shhh
🥷
shhh
4 followers · 0 following

Achievements

Achievement: StarstruckAchievement: YOLOAchievement: Pull SharkAchievement: Quickdraw

Achievements

Achievement: StarstruckAchievement: YOLOAchievement: Pull SharkAchievement: Quickdraw

Highlights

Block or report vinzabe

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
vinzabe/README.md

Terminal: vinzabe@github:~$ whoami, Grant Abejar

🛡️ Security contributions

Vulnerabilities and bugs I've reported to open-source projects. Disclosed findings link to their advisory or issue; the rest link to the project.

17 projects · 2 published advisories · 4 fixed upstream · 996k stars across projects

Disclosed

excon/excon: GHSA-h8qf-v835-mx7g (high 8.5). Case sensitive redaction for redirect follower nuxt/nuxt: CVE-2026-119200 (medium 6.5). Dot segments in the request path bypass server/middleware path checks and server route rules on page routes pnpm/pnpm: Issue #17205 (fixed). pnpm 12.14.0 retries a rejected tar-entry fetch for one minute, stalling CI installs honojs/hono: Issue #5592 (fixed). cache middleware caches cookie-authenticated responses per URL, disclosing one user's data to another

Reported privately

Sent through GitHub's private vulnerability reporting. Details stay private until each advisory is published, then the card switches to the full write-up.

morluto/rea: Reported privately. Reverse engineer anything with agents, from app behavior down to native binaries. thedotmack/claude-mem: Reported privately. Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More python/cpython: Reported privately. The Python programming language cline/cline: Reported privately. Autonomous coding agent as an SDK, IDE extension, or CLI assistant. calcom/cal.diy: Reported privately. Scheduling infrastructure for absolutely everyone. php/php-src: Reported privately. The PHP Interpreter fosrl/pangolin: Reported privately. Modern networking and security platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users. elysiajs/elysia: Reported privately. Ergonomic Framework for Humans tobychui/zoraxy: Reported privately. A general purpose HTTP reverse proxy and forwarding tool. Now written in Go! pomerium/pomerium: Reported privately. Pomerium is an identity and context-aware access proxy. delvedor/find-my-way: Reported privately. A crazy fast HTTP router SinTan1729/chhoto-url: Reported privately. A simple, blazingly fast, selfhosted URL shortener with no unnecessary features; written in Rust SuiteCRM/SuiteCRM-Core: Reported privately. SuiteCRM - Open source CRM for the world

📋 Disclosure log (4 entries)
Date Project Finding Status
2026‑10‑30 honojs/hono Issue #5592 cache middleware caches cookie-authenticated responses per URL, disclosing one user's data to another ✅ Fixed
2026‑10‑28 excon/excon GHSA-h8qf-v835-mx7g Case sensitive redaction for redirect follower 🟠 High
2026‑10‑27 nuxt/nuxt CVE-2026-119200 · GHSA-9v7c-q64q-vv33 Dot segments in the request path bypass server/middleware path checks and server route rules on page routes 🟡 Medium
2026‑10‑21 pnpm/pnpm Issue #17205 pnpm 12.14.0 retries a rejected tar-entry fetch for one minute, stalling CI installs ✅ Fixed

📈 Activity

Snake eating the contribution graph

Cards are built from the GitHub API by scripts/generate.py and refreshed every 6 hours by GitHub Actions.

Popular repositories Loading

  1. PERMANENT-opencode-anthropic-oauth-fix PERMANENT-opencode-anthropic-oauth-fix Public

    Drop-in patched dist/index.js for op-anthropic-auth@0.1.1: fixes Anthropic third-party classifier 400s and /messages vs /v1/messages path mismatch in opencode

    Shell 19 2

  2. opencode-anthropic-max-fix opencode-anthropic-max-fix Public

    Fixes Claude Pro/Max 429 / out-of-credit errors in opencode by installing op-anthropic-auth@0.1.1 with OAuth billing headers, pinning it in config, and watching for bun-install overwrites

    JavaScript 7 2

  3. rl-ids rl-ids Public

    RL intrusion detection: defender agent (Random / Heuristic / Q-learning / DQN) over streaming flow features picks IGNORE/ALERT/BLOCK under a configurable cost matrix

    Python 2

  4. llm-firewall-v2 llm-firewall-v2 Public

    Prompt-injection firewall with a shadow-mode discipline: detectors must meet a measured false-positive budget on real traffic before they may block. Layered OWASP-LLM01 detectors + promotion gate.

    Python 1

  5. CT-SaaS CT-SaaS Public

    Cloud Torrent SaaS - Multi-tenant torrent download platform with user accounts, storage quotas, and API access

    Go 1

  6. ghidra-llm-copilot ghidra-llm-copilot Public

    An LLM copilot for reverse engineering built around one truth: decompiled code is attacker-controlled and the copilot is a prompt-injection surface. A naive copilot is hijacked into calling malware…

    Python 1