| API Security | CVE research · OWASP · Burp extensions |
| Cryptography | Circuit audits · SMT validation . E2E encryption |
| Red team tools | Async scanners · SARIF · CVE tooling |
| Privacy Tools | ZK proofs · XChaCha20 · Deniability |
| ID | Target | Severity | Vector | Status |
|---|---|---|---|---|
| GHSA-wr6f-c7g2-gmfj | circomlib — Underconstrained Decoder |
 |
ZK circuit logic | Published |
| GHSA-22mg-j6pf-g6v4 | zkevm-prover — Unauthenticated gRPC |
 |
Network exposure | Published |
| Pending | zk-email-verify — Signature replay |
|
Cross-instance replay | Coordinated |
| Pending | eigen-zkvm — FFT missing canonical bound |
 |
Circuit arithmetic | Coordinated |
All findings formally validated with Z3/CVC5 SMT solvers before disclosure. No technical details released without a GHSA in place.
| Project | Description | Tech |
|---|---|---|
| Timeseal | Time-locked encryption vault · Dead Man's Switch · AES-256 split-key | TypeScript Next.js CF Workers |
| Sanctum | Zero-trust vault · XChaCha20-Poly1305 · Argon2id · Plausible deniability | TypeScript Next.js CF Workers |
| Ghostreceipt | ZK payment proofs · PII redaction · Multi-chain consensus oracle | TypeScript Next.js CF Workers |
| GhostChat | True P2P encrypted chat · WebRTC · serverless · self-destructing | TypeScript Next.js CF Workers |
| xmrproof | Monero payment verification · 100% client-side | TypeScript Next.js CF Workers |
| TrustCircle | File timestamping vault on IPFS | TypeScript Next.js CF Workers |
| Project | Description | Tech |
|---|---|---|
| Sanitizit | Auto-redact PII before sharing with AI assistants | TypeScript |
| ScrambleText | Homoglyph transforms to evade AI/moderation systems | TypeScript |
| LibreWolfTorRouting | One-click Tor routing for LibreWolf | TypeScript |
| Project | Description | Tech |
|---|---|---|
| BurpAPISecuritySuite | 15 attack types · 108+ payloads · BOLA/IDOR detection · AI integration · OWASP API Top 10 | Python |
| BurpWpsScan | WordPress deep scanning extension | Python |
| BurpCopyIssues | Easy issue copy extension | Python |
| BurpComplianceScanner | Compliance and regulatory scan automation | Python |
| Project | Description | Tech |
|---|---|---|
| DiffCatcher | Git repo discovery · diff capture · code element extraction | Rust |
| ZkPatternMatcher | YAML-pattern vuln detection for ZK circuits | Rust |
| SeekYou | OSINT on IP / domain / ASN | TypeScript Next.js CF Workers |
| IotScanner | IoT device vulnerability scanner | Python |
| McPwn | MCP vulnerability scanner | Python |
| honeypotscan | Honeypot token scanner · 13 scam patterns · ETH/Polygon/Arbitrum | TypeScript Next.js CF Workers |
| Project | Description | Tech |
|---|---|---|
| zklibreports | Public ZK audit reports and security analyses | Shell |
| circomlib-exploit | PoC for underconstrained Decoder vulnerability | Shell |
| zk-email-verify-exploit | PoC for cross-instance signature replay | Shell |
| zkevm-prover-exploit | PoC for unauthenticated gRPC exposure | Shell |
| fft-exploit-poc | FFT circuit missing canonical bound PoC | Shell |