Skip to content

Writing

Writing

Two kinds of pieces, one feed: writeups — technical deep-dives on the bugs I find — and articles — essays on Rust, tooling, and methodology. Each card is tagged so you know which is which.

#Rust 3 #AI 3 #Hugin 2 #tooling 2 #security 1 #Anthropic 1 #surveillance 1 #open source 1 #policy 1 #JavaScript 1 #systems 1 #security tooling 1 #methodology 1 #bug-bounty 1
Article 7 min read // flagship

Enterprise-grade, from scratch

2.7 million lines of Rust, sixty-nine crates, one binary, an OOB server we own, and an AI that writes its own exploits. Almost a year of building Hugin to a bar that is not easily achievable.

#Hugin#Rust#tooling#AI
Article 6 min read // flagship

This is the endgame for Anthropic

Anthropic has been covertly watermarking your Claude Code system prompt based on your timezone and proxy settings. I verified it in my own binary, version 2.1.190. Here is exactly what the code does.

#AI#security#Anthropic#surveillance
Article 6 min read // flagship

Open source is the exit

The US government can switch off a frontier model overnight. China is giving away models that are just as good. The closed-AI giants are in deeper trouble than they admit — and funding them is a bad bet.

#AI#open source#policy
Article 4 min read // flagship

JavaScript is the past

JavaScript won the browser, but the next edge in security tooling belongs closer to the machine: native binaries, memory-safe systems code, and tools that can keep up with the protocols.

#Rust#JavaScript#systems#security tooling
Article 2 min read

Read the scope first

Most of the time I lose on a target is lost to my own setup and assumptions — not the target. A short note on the boring discipline that actually moves findings.

#methodology#bug-bounty
Article 3 min read // flagship

Why I built Hugin

Every engine in Hugin is mine, written from scratch in Rust. The honest version of why it exists, before it ships.

#Hugin#Rust#tooling