back to writing
Tag: security
2 posts
- Reporting a ReDoS to axios: The Mutant That Talked Me Out of the Right AnswerI reported a quadratic-backtracking ReDoS in axios's proxy-bypass helper, and the fix shipped in a release three weeks before the advisory said the bug existed. Then I ran a measurement that overruled a conclusion I had got right.
- The Missing Layer: Static Security Analysis for CLAUDE.md and AGENTS.mdOWASP LLM Top 10 risks live in your instruction files. Runtime evals don't lint them. Here's what static security analysis catches — with a concrete finding.