- 🔨 Building bough, which reads your Claude Code and Codex history and draws what you actually built
- 🔍 Breaking MCP servers & Web Applications mostly. Path traversal, injection, the usual
- ⚙️ Reach for: security issues in the tools everyone is wiring up
- 💬
pingme aboutAI,MCP,coding agents, orAI security
- SSRF to private hosts in the MCP Ruby SDK ·
GHSA-4m5j-jjfc-97gx - Cross-origin redirects leak headers and bodies in the MCP Python SDK ·
GHSA-5h93-6whr-6q8j - HTTP sessions never reclaimed in the MCP Python SDK ·
GHSA-84m7-p3x7-pcfv·CVE-2026-59951 - Cross-origin redirects leak headers and bodies in the MCP TypeScript SDK ·
GHSA-6prh-2h8m-c8cw - Path traversal in CircleCI's MCP server ·
GHSA-4pxc-9x5p-39fc - Malformed JSON-RPC crashes the MCP PHP SDK ·
php-sdk#412