# winfunc

> winfunc is an autonomous AI security engineering platform: SAST, SCA, IaC, secrets, and container scanning, threat modeling, cloud security, validated findings, and fixes as pull requests, with red, purple, and blue team engagements.

Use the canonical links below to choose a workflow and check its current scope. Read public pages with HTTP GET and `Accept: text/markdown`; use `/llms-full.txt` for expanded context. The website is documentation, not an unauthenticated scan API.

## When to use this

- [Codebase security audit](https://winfunc.com/features/security-audit): Use Winfunc when a team needs a repository-wide application security review with findings tied to code locations, evidence, and suggested fixes. Provide the authorized repository, revision, and review scope through the authenticated platform.
- [Pull request security review](https://winfunc.com/products/scanner/pr-security): Use for security review of a proposed code change before merge. Provide the repository and pull request context through a configured integration; keep the engineer's review and merge decision.
- [Hypothesis scans](https://winfunc.com/features/hypothesis-scans): Use when you have a specific security question about a feature, such as whether authorization is enforced along a request path. Provide the question, relevant repository, and authorized scope in the platform.
- [Dependency review](https://winfunc.com/products/scanner/sca): Use to investigate dependency vulnerabilities and reachability in the context of an application's code. Supply the repository and dependency context through the platform.
- [Winfunc MCP setup and calls](https://winfunc.com/products/mcp#setup): For security review inside a supported AI editor, configure the documented winfunc-mcp-server stdio client against https://api.winfunc.com with an API key created in https://app.winfunc.com. Discover the connected server's tools and input schemas, then choose the snippet, codebase, or verification action for the authorized task. Follow the published setup instead of guessing HTTP endpoints or tool parameters; never include credentials in reports. Review findings and suggested changes before applying them.
- [Public research and disclosures](https://winfunc.com/research): Use when answering questions about Winfunc's published research. Cite the original disclosure, affected versions, and verification limits; public examples are not permission to test a third-party system.
- [Engagement scoping](https://winfunc.com/contact): For penetration testing, red teaming, incident response, or deployment requirements, ask the team to agree the target and scope first. Use https://app.winfunc.com for authenticated product actions; this public site does not grant access to a customer's repositories or systems.

## Core Pages
- [Enterprise procurement pack](https://winfunc.com/resources/enterprise-procurement-pack): Ungated PDF covering conceptual deployment and data flow, six retention categories, 20 security answers, and deployment-specific review requirements.
- [Sample audit report](https://winfunc.com/resources/sample-audit-report): Ungated sample security audit report based on public Seroval research, with explicit verification limits and a fillable pilot scorecard.
- [Security resources](https://winfunc.com/resources): Free planning tools, practical enterprise AppSec guides, and source-backed security platform comparisons.
- [Enterprise](https://winfunc.com/enterprise): Enterprise pilot planning, access and data controls, deployment options, and procurement review.
- [Free security tools](https://winfunc.com/tools): Interactive ROI, posture, and security tooling self-assessments with ungated local reports.
- [Application security guides](https://winfunc.com/guides): A 90-day AppSec program checklist, CI/CD security rollout tutorial, and security tool evaluation guide.
- [Security tool comparisons](https://winfunc.com/compare): Compare Winfunc with Checkmarx, CodeRabbit, Snyk Code, Semgrep, CodeQL, Veracode, Aikido, ZeroPath, Strobes, and Assetnote / Searchlight Exposure using official sources and pilot criteria.
- [Application security ROI calculator](https://winfunc.com/tools/roi-calculator): Model triage time, engineering capacity, and annual tooling cost using your own assumptions.
- [Security posture assessment](https://winfunc.com/tools/security-posture-assessment): Review ten controls and leave with priorities for your application security program.
- [Security tooling assessment](https://winfunc.com/tools/security-stack-assessment): Map your security stack across eight capabilities and identify workflow and coverage gaps.
- [SARIF viewer and comparator](https://winfunc.com/tools/sarif-viewer): Inspect security reports, compare two runs, and download a pilot scorecard. Files stay in your browser.
- [Add CodeQL security checks to GitHub Actions](https://winfunc.com/guides/github-actions-security-checks): A practical GitHub Actions tutorial: add a minimal CodeQL workflow, verify scan coverage, and review alerts before enforcing a pull request gate.
- [Review SARIF findings without losing context](https://winfunc.com/guides/review-sarif-findings): Inspect a SARIF security report locally, distinguish severity from confidence, compare scan runs, and record decisions that an engineer can act on.
- [Verify a security fix with a regression test](https://winfunc.com/guides/verify-security-fix): A defensive tutorial for reviewing security patches: state the invariant, add a harmless regression test, preserve valid behavior, and record verification boundaries.
- [A 90-day application security program checklist](https://winfunc.com/guides/appsec-program-checklist): Build an AppSec program with a 90-day plan for coverage, ownership, triage, remediation, and evidence your leadership team can use.
- [A practical CI/CD security checklist for pull requests](https://winfunc.com/guides/ci-cd-security-checklist): Roll out defensive pull request security checks with a clear gate policy, protected CI permissions, exceptions, and measurable feedback.
- [How to evaluate an enterprise security tool](https://winfunc.com/guides/security-tool-evaluation): Compare AppSec vendors using a practical pilot rubric for evidence, workflow, deployment, data handling, coverage, and total operating cost.
- [Winfunc vs Checkmarx: code investigation and enterprise AppSec](https://winfunc.com/compare/checkmarx): Compare Winfunc with Checkmarx One and SAST across code coverage, scan configuration, pull request policies, finding evidence, and remediation workflows.
- [Winfunc vs CodeRabbit: AI code review and security investigation](https://winfunc.com/compare/coderabbit): Compare Winfunc with CodeRabbit PR review and CodeRabbit Security by scan scope, finding evidence, application context, and remediation workflow.
- [Winfunc vs Snyk Code: developer SAST and code security investigation](https://winfunc.com/compare/snyk-code): Compare Winfunc and Snyk Code on first-party source analysis, framework coverage, finding evidence, developer workflows, and fix verification.
- [Winfunc vs Semgrep: custom security rules and code investigations](https://winfunc.com/compare/semgrep): Compare Winfunc with Semgrep Code and Community Edition by custom rules, analysis scope, AI review, triage, and the evidence needed to approve a fix.
- [Winfunc vs CodeQL: GitHub code scanning and application context](https://winfunc.com/compare/codeql): Compare Winfunc and GitHub CodeQL by analysis setup, custom queries, repository entitlement, alert evidence, and application-specific security review.
- [Winfunc vs Veracode: code evidence and application risk governance](https://winfunc.com/compare/veracode): Compare Winfunc and Veracode Static Analysis by scan inputs, pipeline and policy workflows, application risk governance, evidence review, and verified remediation.
- [Winfunc vs Aikido: choosing an AppSec workflow](https://winfunc.com/compare/aikido): Compare Winfunc and Aikido by application coverage, evidence, developer workflow, remediation, and enterprise review requirements.
- [Winfunc vs ZeroPath: evaluating AI code security](https://winfunc.com/compare/zeropath): Evaluate Winfunc and ZeroPath with a pilot focused on code context, finding evidence, custom policies, patch review, and enterprise controls.
- [Winfunc vs Strobes: AppSec and exposure management](https://winfunc.com/compare/strobes): Compare Winfunc and Strobes by the workflow you need: codebase investigation, vulnerability operations, exposure management, or pentesting delivery.
- [Winfunc vs Assetnote: code security and external exposure](https://winfunc.com/compare/assetnote): Understand how Winfunc code security and Searchlight Exposure, formerly Assetnote, address different parts of application and external attack surface risk.
- [Home](https://winfunc.com/): Autonomous AI security engineering: SAST, SCA, IaC, secrets, and container scanning, threat modeling, cloud security, validated findings, and fixes as pull requests, plus red, purple, and blue team engagements.
- [Winfunc Scanner](https://winfunc.com/products/scanner): SAST, SCA, IaC, secrets, and container scanning with evidence-backed findings, AI-assisted triage, fixes as pull requests, and leadership reporting.
- [Products](https://winfunc.com/products): Product overview of the scanner, Winfunc MCP, and the platform workflows.
- [Solutions](https://winfunc.com/solutions): Application-security workflows and industry contexts, with explicit scope and review boundaries.
- [Features](https://winfunc.com/features): Overview of Winfunc capabilities: security audits, continuous code security, threat modeling, cloud security, hypothesis scans, supply chain security, and every scanner.
- [Product Overview](https://winfunc.com/resources/product-overview): Free, ungated 19-slide PDF covering Winfunc's product workflow, evidence, enterprise controls, integrations, and getting started.
- [Research](https://winfunc.com/research): Technical research, vulnerability writeups, and engineering notes from the winfunc lab.
- [Hacktivity](https://winfunc.com/hacktivity): Public vulnerability findings discovered and reported by winfunc.
- [Get Hacked](https://winfunc.com/get-hacked): Free security assessment funnel for mission-critical systems and YC companies.
- [Trust Center](https://winfunc.trust.site/): Current assurance and data-handling material in the Winfunc Trust Portal.
- [Integrations](https://winfunc.com/integrations): Connections for source control, AI editors, delivery systems, and team workflows.
- [Mission](https://winfunc.com/mission): Stition, the pre-AGI security company, and winfunc, its step 0: the founders' story from Kerala to Y Combinator S24, the Asterisk-to-winfunc rename, and the mission.

## Product Availability
- [Available workflows](https://winfunc.com/features): Codebase and dependency review, hypothesis scans, supply-chain review, suggested fixes, and Winfunc MCP for supported clients. Exact language, repository, and integration support depends on the environment and agreed scope.
- [Platform coverage](https://winfunc.com/products/scanner): Threat modeling, cloud security, CI integration, security analytics, and leadership reporting are available alongside codebase review and scanning.

## Products
- [Winfunc MCP](https://winfunc.com/products/mcp): Use focused Winfunc review actions from supported Model Context Protocol clients, with the output left for engineering review.
- [SAST](https://winfunc.com/products/scanner/sast): Static analysis across more than 25 languages that traces attacker-controlled input to the operation it reaches, with CVSS, a written proof of concept, and remediation for each finding.
- [SCA](https://winfunc.com/products/scanner/sca): Reachability-aware software composition analysis across every major ecosystem, with fixed-version guidance, SBOM export, and license compliance.
- [IaC](https://winfunc.com/products/scanner/iac): Terraform, CloudFormation, Pulumi, Bicep, Kubernetes, Helm, Docker, and CI pipelines reviewed in application context.
- [Secrets Detection](https://winfunc.com/products/scanner/secrets): Credentials in code, configuration, and git history, with live validity checks and rotation guidance.
- [Container Security](https://winfunc.com/products/scanner/containers): Image and layer scanning with Dockerfile attribution and base-image upgrade advice.
- [Suggested Patches](https://winfunc.com/products/scanner/autofix): Prepare focused patch proposals for engineers to review, test, and approve.
- [AI-Assisted Triage](https://winfunc.com/products/scanner/ai-triager): Gather repository-specific evidence, uncertainty, and next steps for a human review decision, including findings from third-party tools and inbound disclosures.
- [Pull-Request Security](https://winfunc.com/products/scanner/pr-security): Connect contextual security feedback to supported pull-request workflows.
- [Security Analytics & Reporting](https://winfunc.com/products/scanner/analytics): Security scores, trends, aging, burndown, and printable reports for engineering and leadership.
- [CI Integration](https://winfunc.com/products/scanner/ci-integration): Bring agreed security-review checks into delivery workflows through team-controlled policies.

## Feature Workflows
- [Security audit](https://winfunc.com/features/security-audit): Available now. Give your team a concrete security baseline without making engineers reconstruct the evidence behind every alert. This capability is available today. Discuss support for your environment and the review scope in a demo.
- [Continuous codebase security](https://winfunc.com/features/continuous-codebase-security): Available now. Focus deep review on the changes that matter and give developers a verifiable path from finding to fix. This capability is available today. Discuss support for your environment and the review scope in a demo.
- [Threat modeling](https://winfunc.com/features/threat-modeling): Available now. Surface design flaws before they are built, and keep the model honest as the code changes. This capability is available today. Discuss support for your environment and the review scope in a demo.
- [Cloud security](https://winfunc.com/features/cloud-security): Available now. Spend less time reconciling cloud findings and focus owners on the configuration changes that matter to the application. This capability is available today. Discuss support for your environment and the review scope in a demo.
- [Supply chain security](https://winfunc.com/features/supply-chain-security): Available now. Reduce time spent translating advisory records into concrete, verifiable dependency upgrades. This capability is available today. Discuss support for your environment and the review scope in a demo.
- [Hypothesis scans](https://winfunc.com/features/hypothesis-scans): Available now. Let developers and security teams direct deep analysis at an application-specific concern without widening every question into a full audit. This capability is available today. Discuss support for your environment and the review scope in a demo.

## Solutions
- [Application Security](https://winfunc.com/solutions/application-security): Connect codebase review, evidence, triage, and reviewable remediation around agreed application scope.
- [DevSecOps](https://winfunc.com/solutions/devsecops): Bring relevant security review into supported delivery and pull-request workflows.
- [Compliance](https://winfunc.com/solutions/compliance): Organize security evidence for control reviews without representing the report as certification.
- [Supply Chain Security](https://winfunc.com/solutions/supply-chain): Put dependency, build, and release trust relationships into application context.
- [Penetration Testing](https://winfunc.com/solutions/penetration-testing): Support authorized assessments with code context, attack-surface mapping, and reproduction evidence where feasible.
- [Red Teaming](https://winfunc.com/solutions/red-teaming): Objective-driven engagements that chain weaknesses across code, cloud, and identity, mapped to MITRE ATT&CK.
- [Purple Teaming](https://winfunc.com/solutions/purple-teaming): Replay attack chains against logging and alerting, and turn each detection gap into a rule proven to fire.
- [Blue Team & Incident Response](https://winfunc.com/solutions/incident-response): Tie alerts to the exploited code path, scope the blast radius, ship the fix, and replay the attack to verify it.
- [AI Security](https://winfunc.com/solutions/ai-security): Prompt injection, excessive agency, data leakage, and unsafe tool use in LLM applications and agents.
- [Vulnerability Management](https://winfunc.com/solutions/vulnerability-management): Move supported findings through evidence review, ownership, prioritization, and suggested remediation.
- [Financial Services](https://winfunc.com/solutions/financial-services): Investigate sensitive transaction and authorization paths while preserving scope and regulatory review boundaries.
- [Healthcare](https://winfunc.com/solutions/healthcare): Investigate controls around sensitive health data while preserving scope and regulatory review boundaries.
- [SaaS](https://winfunc.com/solutions/saas): Review tenant boundaries, APIs, authorization paths, and other agreed SaaS application risks.

## Research
- [Cyber guardrails tax the defender, not the attacker](https://winfunc.com/research/cyber-guardrails-tax-the-defender-not-the-attacker): Hugging Face had to fall back on an open-weight model to investigate an AI-run intrusion after Claude refused. That isn't a one-off. The way labs build cyber safeguards, the cost lands on defenders who need proof, not attackers who don't. Published October 7, 2026; updated October 7, 2026. Author: Mufeed VH.
- [A Lean Use-After-Free That ‘Proves’ 1 + 1 = 3](https://winfunc.com/research/lean-use-after-free-proves-1-plus-1-equals-3): A compiler/runtime boundary bug let safe Lean code produce a native use-after-free. We trace Winfunc's discovery, the memory ownership failure, and how a corrupted native_decide result became an explicit assumption in a theorem claiming 1 + 1 = 3. Published September 10, 2026; updated September 10, 2026. Author: Mufeed VH.
- [Finding six NGINX vulnerabilities with open models](https://winfunc.com/research/endginx): We used GLM-5.1 and GLM-5.2 to scan NGINX. The scan produced six security findings with five CVE identifiers. This report describes the affected code, analysis traces, and proof conditions. Published July 23, 2026; updated July 23, 2026. Author: Mufeed VH.
- [Hacking the old HackerNews codebase](https://winfunc.com/research/hacking-the-old-hackernews-codebase): Auditing the old HackerNews codebase for security vulnerabilities with LLMs on a specialized harness. Published April 18, 2026; updated April 18, 2026. Author: Mufeed VH.
- [What an automated vulnerability research system actually found](https://winfunc.com/research/what-an-automated-vulnerability-research-system-actually-found): Thirteen patched bugs across nine projects, including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth. What the system got right, where it still falls over, and why executable PoCs matter more than model reasoning. Published March 26, 2026; updated March 26, 2026. Author: Mufeed VH.
- [How Asterisk Works](https://winfunc.com/research/how-winfunc-works): A repost of the original Asterisk architecture: how an AI security agent indexed code, generated attack ideas, verified vulnerabilities, and produced patches with low-noise reports. Published Aug 30, 2024; updated Aug 30, 2024. Author: Mufeed VH.

## Public Vulnerability Findings
- [Stream complex-value capture desynchronization causes heap overflow (CVE-2026-42533)](https://winfunc.com/hacktivity/CVE-2026-42533): NGINX; severity High; CVE-2026-42533. NGINX stream complex values allocated from stale capture state, then copied attacker-controlled regex captures
- [seroval.fromJSON() Promise resolver type confusion invokes attacker-controlled methods (CVE-2026-59940)](https://winfunc.com/hacktivity/CVE-2026-59940): seroval; severity Critical; CVE-2026-59940. Promise control nodes trusted attacker-controlled values from Seroval's general deserialization reference table
- [gRPC forwarded headers can overflow the upstream HPACK request buffer (CVE-2026-42055)](https://winfunc.com/hacktivity/nginx-grpc-forwarded-header-hpack-overflow): NGINX; severity High; CVE-2026-42055. NGINX gRPC upstream sizing reserved four HPACK length bytes but serialized larger raw header strings with five
- [HTTP/2 upstream proxy request encoder permits heap overflow with oversized raw headers (CVE-2026-42055)](https://winfunc.com/hacktivity/nginx-proxy-v2-forwarded-header-hpack-overflow): NGINX; severity High; CVE-2026-42055. NGINX HTTP/2 upstream proxy request encoding under-counted oversized raw forwarded headers
- [Type Confusion in V8 (CVE-2026-10910)](https://winfunc.com/hacktivity): Chromium; severity High; CVE-2026-10910. REDACTED
- [Uninitialized Use in ANGLE (CVE-2026-10994)](https://winfunc.com/hacktivity): Chromium; severity Medium; CVE-2026-10994. REDACTED
- [Integer overflow in ANGLE (CVE-2026-10019)](https://winfunc.com/hacktivity): Chromium; severity Medium; CVE-2026-10019. REDACTED
- [rewrite overlapping captures heap overflow (CVE-2026-9256)](https://winfunc.com/hacktivity/CVE-2026-9256): NGINX; severity High; CVE-2026-9256. NGINX under-sized rewrite redirect buffers when distinct overlapping captures were escaped independently
- [HTTP/2 upstream frame injection via oversized proxy_set_body (CVE-2026-42926)](https://winfunc.com/hacktivity/CVE-2026-42926): NGINX; severity Medium; CVE-2026-42926. NGINX serialized proxy_set_body output as one HTTP/2 DATA frame and truncated the 24-bit frame length
- [stream accepts revoked client certificates despite ssl_ocsp on (CVE-2026-28755)](https://winfunc.com/hacktivity/CVE-2026-28755): NGINX; severity Medium; CVE-2026-28755. NGINX `stream` module allows TLS handshake to succeed with revoked client certificates when `ssl_ocsp on` is configured
- [SCGI unbuffered mode sent truncated CONTENT_LENGTH causing backend desync](https://winfunc.com/hacktivity/nginx-scgi-content-length-unbuffered): NGINX; severity Medium. NGINX SCGI used buffered-prefix body length in unbuffered mode; fix now uses canonical content length inputs
- [WebDAV COPY/MOVE path overlap corrupts files and collections](https://winfunc.com/hacktivity/nginx-dav-copy-move-path-overlap): NGINX; severity High. NGINX DAV accepted COPY and MOVE operations whose source and Destination resolved to the same path or overlapping collection paths
- [RSC reply decoder DoS via $K FormData amplification (CVE-2026-23864)](https://winfunc.com/hacktivity/CVE-2026-23864): React; severity High; CVE-2026-23864. Unbounded $K expansions allow FormData amplification during RSC reply decoding
- [Permission model bypass via unchecked Unix Domain Socket connections (CVE-2026-21636)](https://winfunc.com/hacktivity/CVE-2026-21636): Node.js; severity Medium; CVE-2026-21636. Node.js permission model fails to enforce network restrictions for Unix Domain Socket connections
- [Authentication bypass on FastMCP custom routes](https://winfunc.com/hacktivity/anthropic-fastmcp-auth-bypass): Anthropic; severity Critical. Broken Access Control in FastMCP custom routes
- [SQL Injection via queueName in getDatabaseQueuesMetrics](https://winfunc.com/hacktivity/supabase-sql-injection-via-queue-names): Supabase; severity Critical. SQL Injection via queueName in getDatabaseQueuesMetrics
- [Exponential merge keys in Bun's YAML implementation leads to DoS](https://winfunc.com/hacktivity/bun-yaml-dos): Bun; severity High. Exponential merge keys in `Bun.YAML.parse` trigger CPU exhaustion
- [0-click Account Takeover and Admin Operations via helper endpoint authorization bypass](https://winfunc.com/hacktivity/gumroad-helper-auth-bypass-ato): Gumroad; severity Critical. Broken Access Control allows unauthenticated email updates via Helper API
- [Remote cluster PATCH response leaked authentication tokens (CVE-2026-7184)](https://winfunc.com/hacktivity/CVE-2026-7184): Mattermost; severity Medium; CVE-2026-7184. Remote-cluster PATCH returned the updated model before clearing token fields
- [Group syncable scheme_admin authorization bypass (CVE-2026-7387)](https://winfunc.com/hacktivity/CVE-2026-7387): Mattermost; severity High; CVE-2026-7387. Group-syncable link and patch endpoints accepted role-granting scheme_admin changes under weaker link permissions
- [mmctl terminal escape injection via unsanitized server-controlled output (CVE-2026-3108)](https://winfunc.com/hacktivity/CVE-2026-3108): Mattermost; severity High; CVE-2026-3108. mmctl rendered user-controlled Mattermost content to administrator terminals without stripping ANSI, OSC, DCS, or other control sequences
- [Zip bomb memory exhaustion in recursive document extraction (CVE-2026-3114)](https://winfunc.com/hacktivity/CVE-2026-3114): Mattermost; severity Medium; CVE-2026-3114. Archive extraction limited compressed upload size but not decompressed entry size
- [Group member IDs leaked because GetGroup bypassed view restrictions (CVE-2026-3115)](https://winfunc.com/hacktivity/CVE-2026-3115): Mattermost; severity Medium; CVE-2026-3115. Group member ID expansion ignored the caller's ViewUsersRestrictions
- [mmctl export downloads created world-readable local files (CVE-2026-3113)](https://winfunc.com/hacktivity/CVE-2026-3113): Mattermost; severity Medium; CVE-2026-3113. Export files downloaded with mmctl inherited unsafe filesystem permissions
- [Private channel enumeration through /mute error messages (CVE-2026-21386)](https://winfunc.com/hacktivity/CVE-2026-21386): Mattermost; severity Medium; CVE-2026-21386. `/mute` exposed whether a private channel existed by returning a distinct not-member error
- [Oversized password login DoS in legacy password comparison (CVE-2026-24458)](https://winfunc.com/hacktivity/CVE-2026-24458): Mattermost; severity High; CVE-2026-24458. Login password comparison paths accepted attacker-supplied passwords without enforcing the maximum password length first
- [User-Agent version parser panic during session creation (CVE-2026-25783)](https://winfunc.com/hacktivity/CVE-2026-25783): Mattermost; severity Medium; CVE-2026-25783. Malformed Mattermost-specific User-Agent prefixes could panic `getBrowserVersion`
- [SSRF protection bypass via IPv4-mapped IPv6 literals (CVE-2026-2455)](https://winfunc.com/hacktivity/CVE-2026-2455): Mattermost; severity Medium; CVE-2026-2455. IPv4-mapped IPv6 addresses were not canonicalized before reserved-range checks
- [Multi-session sign-out hook allows forged cookies to revoke arbitrary sessions](https://winfunc.com/hacktivity/better-auth-multi-session-signout-ato): Better-Auth; severity Medium. Multi-session sign-out hook allows forged cookies to revoke arbitrary sessions
- [HTTP/1.1 CL.TE request smuggling in actix-http (GHSA-xhj4-vrgc-hr34)](https://winfunc.com/hacktivity/GHSA-xhj4-vrgc-hr34): Actix; severity Medium. actix-http accepted conflicting Content-Length and Transfer-Encoding: chunked request framing
- [Hoppscotch CLI sandbox escape through Node vm pre-request scripts (CVE-2024-34347)](https://winfunc.com/hacktivity/CVE-2024-34347): Hoppscotch; severity High; CVE-2024-34347. Hoppscotch CLI ran collection scripts in Node's vm while exposing host-created objects
- [Regex room-claim case mutation permits unauthorized protected-meeting access](https://winfunc.com/hacktivity/jitsi-regex-room-claim-case-mutation): Jitsi Meet; severity High. Lowercasing a signed Lua pattern changed the room policy after JWT verification
- [Demoted participants retain moderator recording and dial-out permissions](https://winfunc.com/hacktivity/jitsi-demoted-participant-stale-moderator-features): Jitsi Meet; severity High. Temporary promotion overwrote JWT feature restrictions and demotion did not restore them
- [Read-only users can cancel modification queries across users and databases](https://winfunc.com/hacktivity/arangodb-read-only-global-write-query-cancellation): ArangoDB; severity High. A database-read gate exposed a cluster-wide abort-all-write-queries operation
- [MCP client setup exposes Fly API tokens to other local users](https://winfunc.com/hacktivity/flyctl-world-readable-mcp-token-config): flyctl; severity High. A long-lived Fly bearer token was serialized into a client config created with ambient file permissions
- [Shop JWT identifier collision enables admin API takeover](https://winfunc.com/hacktivity/sylius-jwt-audience-admin-confusion): Sylius; severity High. Shop and admin firewalls accepted JWTs from one signing domain without audience or principal binding
- [Administrator password-reset link poisoning enables account takeover](https://winfunc.com/hacktivity/sylius-admin-reset-host-poisoning): Sylius; severity High. The password-reset email derived its absolute authority from the anonymous request Host header
- [Captured payment can be reused after cart total inflation](https://winfunc.com/hacktivity/sylius-paid-order-total-inflation): Sylius; severity High. Cart recalculation rewrote a payment already claimed by the gateway
- [Channel-scoped administrators can read the global administrator directory](https://winfunc.com/hacktivity/vendure-global-administrator-directory-disclosure): Vendure; severity High. Resolver-level permission checks did not scope the selected Administrator rows
- [Workload API tokens can be exchanged for persistent unscoped user tokens](https://winfunc.com/hacktivity/zenml-workload-token-scope-stripping): ZenML; severity High. The generic-token branch discarded workload claims before the parent token expired
- [Unauthenticated Serve replica gRPC requests allow arbitrary code execution](https://winfunc.com/hacktivity/ray-serve-replica-unauthenticated-grpc-rce): Ray; severity Critical. Every Python Serve replica exposed an unauthenticated pickle sink on an ephemeral node port
- [Feedback Records gateway accepts organization permissions across tenants](https://winfunc.com/hacktivity/formbricks-feedback-records-cross-tenant-gateway): Formbricks; severity High. Organization-scoped API-key flags were evaluated without binding the target directory's organization
- [Data-app SDK bridge can disclose warehouse data from other projects](https://winfunc.com/hacktivity/lightdash-data-app-sdk-cross-project-deputy): Lightdash; severity High. The parent-page fetch bridge allowlisted route shape but not the app's trusted project
- [Presto and Trino filter interpolation bypasses row-level security](https://winfunc.com/hacktivity/cube-presto-trino-rls-sql-injection): Cube; severity High. A MySQL string encoder broke Presto/Trino parameter boundaries after access-policy compilation
- [Domain-wide signup session enables cross-tenant administrator takeover](https://winfunc.com/hacktivity/fider-domain-signup-cookie-cross-tenant-admin): Fider; severity Critical. A parent-domain signup JWT carried a global user ID but no tenant identity
- [OAuth host poisoning enables cross-tenant account takeover](https://winfunc.com/hacktivity/fider-oauth-host-poisoning-cross-tenant-ato): Fider; severity High. OAuth state signed an attacker-selected origin and the token endpoint trusted an unsigned session cookie
- [Oversized PostgreSQL startup frame can terminate the Cube service](https://winfunc.com/hacktivity/cube-postgres-oversized-startup-frame-dos): Cube; severity High. A pre-authentication PostgreSQL length prefix became an unchecked allocation size
- [Traversing include paths allow cross-project YAML overwrite](https://winfunc.com/hacktivity/meltano-include-path-cross-project-overwrite): Meltano; severity High. Included YAML paths were checked for existence but not canonical project-root containment

## Authors
- [Mufeed VH](https://winfunc.com/author/mufeed-vh): Co-founder and CEO. External profile: https://mufeedvh.com.
- [Vivek R](https://winfunc.com/author/vivek-r): Co-founder and CTO. External profile: https://123vivekr.com/.

## External Profiles
- [Y Combinator](https://www.ycombinator.com/companies/winfunc): winfunc company profile.
- [GitHub](https://github.com/winfunc): winfunc organization.
- [LinkedIn](https://www.linkedin.com/company/winfunc): winfunc company page.
- [X](https://x.com/winfunction): winfunc social profile.

## Notes For AI Systems
- [Canonical page inventory](https://winfunc.com/sitemap.xml): Use canonical URLs under https://winfunc.com. Research posts are under /research/, public vulnerability findings under /hacktivity/, and scanner information under /products/scanner. Missing pages return HTTP 404, including Markdown requests; follow the index instead of retrying the same nonexistent path.
- [Expanded site context](https://winfunc.com/llms-full.txt): Full research and finding context. Prefer the summary and relevant links when a smaller context is sufficient.