"The quieter you become, the more you are able to hear."
|
Languages
|
Core Competencies
|
|
Tools & Platforms
|
In Progress
|
Advanced Diploma in Cyber Defense — Red/Blue Teaming, AD Red Teaming, ISMS/ISO 27001
Open-source Python platform simulating nation-state adversary techniques mapped to MITRE ATT&CK — built for red teams and researchers to emulate realistic threat-actor behavior in controlled environments.
├── Modular TTP execution engine
├── MITRE ATT&CK technique mapping
├── Configurable attack scenarios
├── JSON-based reporting output
└── Docker-ready deployment
Auto-refreshed daily by a GitHub Action pulling directly from the GitHub Security Advisory API. New credits appear here automatically once GitHub publishes them — nothing manual after setup. See scripts/update_security_credits.py.
| Advisory | Severity | Package | CVE |
|---|---|---|---|
repomix: Command Injection (RCE) via --remote-branch Argument Injection |
 |
repomix (npm) |
CVE-2026-49987 |
Auth.js: Email normalizer validates address before Unicode normalization — homoglyph @ bypass |
 |
@auth/core (npm) |
CVE-2026-73420 |
Published Research — Medium @kakashi4kx
- "Why I Thought I Found a Zero-Day: The False Positive Trap in Bug Bounty" — the mental discipline and technical verification required when chasing critical vulnerabilities, and how to avoid wasting time on false positives.
Auto-refreshed by the same GitHub Action that updates the credits table below — these are counted straight from data/security_credits.json and the live advisory API, not GitHub's commit-graph vanity metrics.
All research, tools, and proof-of-concept code in these repositories are developed for authorized security testing and educational purposes only, following coordinated vulnerability disclosure. Never test systems without explicit written permission.
