back to writing
Tag: open-source
2 posts
- Reporting a ReDoS to axios: The Mutant That Talked Me Out of the Right AnswerI reported a quadratic-backtracking ReDoS in axios's proxy-bypass helper, and the fix shipped in a release three weeks before the advisory said the bug existed. Then I ran a measurement that overruled a conclusion I had got right.
- Scoring My Own MCP ContributionA CLAUDE.md I wrote was merged into modelcontextprotocol/servers. My own scorer returned 59.2/100. Where it was right, where it was structurally unfair, and what the gap to 80 would cost.