MUFC | Cybersecurity | AppSec Engineer | The quicker you let go of old cheese, the sooner you find new cheese.~~~~~ Warrior and Survivor

Mars
Joined May 2011
Every morning,a Gazelle wakes up,it knows it must outrun d fastest lion or it will be killed.Also, a lion wakes up, It knows it must run faster than d slowest gazelle, or it will starve. It doesn't matter if you're the lion or a gazelle-when the sun rises, you'd better be running – at Victoria Island, Nigeria
5
11
A guy built an AI that thinks it’s 1899, then tried to get it to beat Einstein to his most famous theories.
241
823
32
12,610
298,238
-----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----
244
3,911
322
41,309
1,045,247
This seems bad.
101
1,755
129
36,468
698,445
Cloudflare open sourced a security audit skill that orchestrates coding agents through six phases of reconnaissance and validation to produce independently verified, machine-readable findings. github.com/cloudflare/securi…
9
58
3
639
46,434
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success. I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉 If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter. It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately. Repo: github.com/nealbridges/VulnH… CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well. I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s Looking forward to developing on this further with the community.
31
220
9
1,564
104,079
An alternative to the fellowships: consider designing your own adventure! (Especially if you're e.g. mid-career or otherwise have constraints that would make it hard to take 3 months off to do a thing. Or if you just hate slogging through applications.) Link in thread!
New post! I've done a few advising calls with people looking to get into AI safety fellowships and realised there's lots of concrete advice I kept on repeating. There's lots of unusual advice that I haven't heard elsewhere, give it a read! lesswrong.com/posts/PiP4JqQF…
6
18
288
18,515
Google Mantis is a skills pack for security review with coding agents Install: npx skills add google/mantis Key commands: /mantis-threat-model: builds a threat model from your codebase
 /mantis-researcher: scans for vulnerabilities
 /mantis-review: filters false positives
 /mantis-reproduce: writes a PoC and runs it in a sandbox
 /mantis-patch: applies a fix and confirms it blocks the PoC
 /mantis-report: generates the final security report This is a good use case for running your agent in a sandbox, since the reproduce and patch steps execute generated code github.com/google/mantis
17
166
7
1,397
111,927
lol. Not the KPMG that I know of sha. Everyone come in as a staff through the same door, even if your dad is the president of the country
105
1,810
64
10,023
427,407
Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate. How it works: blog.google/security/agentic… For real-world vulnerabilities PageBreak has discovered 👇 bughunters.google.com/blog/p…
22
198
9
1,209
98,854
Want to become DANGEROUS with Python? Build these 10 systems:
2
41
338
23,805
10 AWS Projects You Can Build in a Weekend • Static Website → S3 + CloudFront Learn: hosting, CDN & caching • URL Shortener → Lambda + DynamoDB Learn: serverless APIs & NoSQL • Image Resizer → S3 + Lambda Learn: event-driven architecture • Serverless API → API Gateway + Lambda Learn: REST APIs & serverless compute • File Backup System → S3 + Lifecycle Rules Learn: storage classes & automation • Uptime Monitor → CloudWatch + SNS Learn: monitoring & alerting • Contact Form Backend → Lambda + SES Learn: event handling & email workflows • Expense Tracker API → Lambda + DynamoDB Learn: CRUD operations & databases • Log Analytics Setup → CloudWatch + S3 Learn: logging & observability • 3-Tier App → EC2 + RDS Learn: compute, databases & architecture Don’t just build projects. Know what each one teaches you.
2
13
89
3,787
BUILD these 10 AWS Projects to go GOD TIER in AWS:
2
21
146
11,837
This is the neatest tool I've seen in the last 6 months. I've tried a few: they either have a good user interface or a strong security/trust model. github.com/trailofbits/coop Amazing work by @trailofbits
14
66
2
669
50,062
Our craziest escape yet: The @Accomplish_ai research team was able to exploit a vulnerability in Cloudflare Containers that let a sandbox read other customers' files - SQLite DBs, Chromium profiles, .env files etc, Cloudflare Sandboxes and Browser Run run on the same disk implementation and were affected too. We reported this to @Cloudflare, who super quickly fixed it. Read @CloudflareDev post in collaboration with Accomplish researcher @orenyomtov on their official blog: blog.cloudflare.com/containe…
36
90
24
804
131,535
This is a treasure trove of hard-earned lessons. 1/ Shortly after I joined Stripe in 2019, we all went to Convergence (Stripe's employee conference). My manager pulled me aside and said: "You have to talk to Shreyas. You'll learn a ton". He was so right. I was lucky to learn from Shreyas during our time together at Stripe. 2/ Shreyas's video on talking to executives is spot on. At Cloudflare I had the opportunity to present to the entire C-suite every month on a critical initiative. I had to learn how to communicate with executives through my own mistakes. "CxO doesn't want to hear why X is impossible because of how card networks work. Work with Stripe, Treasury, and Finance to figure it out". → "Communicate at their level, not your level". I wish I'd seen Shreyas’s video back then!
I’ve recently released a bunch of career-related videos on YT but haven’t shared any of them here on X. So here they are (sorted by views). Super-candid and direct. I hope you find them useful. 1. How to talk to executives youtu.be/WgFAKCEpEsE
1
12
196
53,644