Skip to content
View vinzabe's full-sized avatar
🥷
shhh
🥷
shhh
4 followers · 0 following

Achievements

Achievement: StarstruckAchievement: YOLOAchievement: Pull SharkAchievement: Quickdraw

Achievements

Achievement: StarstruckAchievement: YOLOAchievement: Pull SharkAchievement: Quickdraw

Highlights

Block or report vinzabe

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
vinzabe/README.md

Terminal: vinzabe@github:~$ whoami, Grant Abejar

🛡️ Security contributions

Vulnerabilities I've reported to open-source projects. Disclosed findings link to their advisories; the rest link to the project.

11 projects · 2 published advisories · 885k stars across projects

Disclosed

excon/excon: GHSA-h8qf-v835-mx7g (high 8.5). Case sensitive redaction for redirect follower nuxt/nuxt: CVE-2026-119200 (medium 6.5). Dot segments in the request path bypass server/middleware path checks and server route rules on page routes

Reported privately

Sent through GitHub's private vulnerability reporting. Details stay private until each advisory is published, then the card switches to the full write-up.

morluto/rea: Reported privately. Reverse engineer anything with agents, from app behavior down to native binaries. thedotmack/claude-mem: Reported privately. Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More python/cpython: Reported privately. The Python programming language cline/cline: Reported privately. Autonomous coding agent as an SDK, IDE extension, or CLI assistant. calcom/cal.diy: Reported privately. Scheduling infrastructure for absolutely everyone. php/php-src: Reported privately. The PHP Interpreter elysiajs/elysia: Reported privately. Ergonomic Framework for Humans delvedor/find-my-way: Reported privately. A crazy fast HTTP router SuiteCRM/SuiteCRM-Core: Reported privately. SuiteCRM - Open source CRM for the world

📋 Disclosure log (2 entries)
Date Project Finding Status
2026‑10‑28 excon/excon GHSA-h8qf-v835-mx7g Case sensitive redaction for redirect follower 🟠 High
2026‑10‑27 nuxt/nuxt CVE-2026-119200 · GHSA-9v7c-q64q-vv33 Dot segments in the request path bypass server/middleware path checks and server route rules on page routes 🟡 Medium

📈 Activity

Snake eating the contribution graph

Cards are built from the GitHub API by scripts/generate.py and refreshed daily by GitHub Actions.

Popular repositories Loading

  1. PERMANENT-opencode-anthropic-oauth-fix PERMANENT-opencode-anthropic-oauth-fix Public

    Drop-in patched dist/index.js for op-anthropic-auth@0.1.1: fixes Anthropic third-party classifier 400s and /messages vs /v1/messages path mismatch in opencode

    Shell 19 2

  2. opencode-anthropic-max-fix opencode-anthropic-max-fix Public

    Fixes Claude Pro/Max 429 / out-of-credit errors in opencode by installing op-anthropic-auth@0.1.1 with OAuth billing headers, pinning it in config, and watching for bun-install overwrites

    JavaScript 7 2

  3. rl-ids rl-ids Public

    RL intrusion detection: defender agent (Random / Heuristic / Q-learning / DQN) over streaming flow features picks IGNORE/ALERT/BLOCK under a configurable cost matrix

    Python 2

  4. llm-firewall-v2 llm-firewall-v2 Public

    Prompt-injection firewall with a shadow-mode discipline: detectors must meet a measured false-positive budget on real traffic before they may block. Layered OWASP-LLM01 detectors + promotion gate.

    Python 1

  5. CT-SaaS CT-SaaS Public

    Cloud Torrent SaaS - Multi-tenant torrent download platform with user accounts, storage quotas, and API access

    Go 1

  6. ghidra-llm-copilot ghidra-llm-copilot Public

    An LLM copilot for reverse engineering built around one truth: decompiled code is attacker-controlled and the copilot is a prompt-injection surface. A naive copilot is hijacked into calling malware…

    Python 1