Software Engineer and Security Researcher
I write Rust that holds up, and I break software that doesn't
Founder of Clickswave. Web apps, binaries, reverse engineering.
Crossfyre runs recon and vulnerability workflows across a fleet of nodes in parallel. Pure Rust, no Python glue.
SiloCat encrypts files in the browser. The server only ever holds ciphertext, so there is nothing useful to leak.
| crossfyre-toolchain | The scanners on their own, in your terminal. It ate voyage and mach. Apache-2.0. |
| silocat | silo.cat's source, so you don't have to take my word about the encryption. AGPL-3.0. |
| limeyard | Deliberately vulnerable targets with an answer key, for finding out how bad your scanner really is. MIT. |
I find them in other people's software and report them privately. They get listed here once the vendors ship fixes, which takes however long it takes.
| CVE-2026-104626 | Gitea, Critical 9.0. Cancel your own fork PR run, wait for a maintainer to click Re-run, and the fork's workflow runs on their runners as root without ever being approved. Five of us found it independently. |
| CVE-2026-104633 | Gitea, Medium 6.5. A migration source reporting a page size of zero sent six download loops round forever. One request took a server from 99MiB to 5.7GB in ninety seconds. |
| CVE-2026-109310 | SiYuan, Medium 6.5. One GET to the dynamic icon endpoint ran an uncapped template function until the kernel was OOM-killed. No login needed on a default publish service. |
| CVE-2026-117677 | Gitea, Medium. A Helm chart upload was decompressed and read to the end before the size quota was checked, so a 1MB chart took a server from 105MiB to over 5GB of memory in 17.5 seconds. Shared with two other reporters. |
| CVE-2026-105661 | Gitea, Medium 5.3. Every anonymous request for an ordinary user's organisation repositories page panicked and wrote a stack trace to the log. Shared with two other reporters. |
| GHSA-4p83-c4wg-59q4 | OpenProject, Medium 4.3. A cache shared between viewers served the first one's permissions to everyone after, so the meeting agenda API leaked private work package subjects. No CVE. |
The ones still with maintainers are counted at crossfyre.io/disclosures.
Contract work and collaborations: team@clickswave.org