Serhii Shunko
Member #4,755DeveloperL2Achievements
Pinned projects
About
I find and report security bugs in open-source software, mostly in two areas.
C/C++ protocol and media parsers: length fields taken on trust, integer underflow, out-of-bounds reads and writes. Examples: RTCP handling in SRS, BACnet stack, DCE/RPC in nDPI, dictionary training in zxc.
AI-agent and MCP tooling: local HTTP servers without Host/Origin checks, SSRF filters, path containment, temp-file handling. Examples: electerm, nektos/act, github/gh-aw, Salesforce B2C DX MCP server, kubernetes-mcp-server.
Reports go privately through each project's own channel, with a local reproducer and a proposed fix. The maintainers decide when to publish.
Tools I maintain: mcp-ssrf-auditor, protobuf-bounds-auditor, c-bounds-audit-framework.
GitHub: ccsimplyspolit · HackerOne and Bugcrowd: sshunko