I just searched my email and found nothing. Do you have subject line, sender address or receipt or anything that would help me find the emails that were sent?
> found your personal Matrix handle. That's when Vhyrro DM'd you on Matrix.
I don't use Matrix. There's a gitter.im for Luarocks that's effectively dead. I last was there in January 2026 asking if the server was alive but never returned. I logged into gitter right now to check and I was able to find a DM request from August 20th, I wouldn't have seen this under any normal circumstances though
Well, thanks for sharing you attempted to contact me at least.
> Apart from that, we couldn't find any alternative way of reaching you.
I'll just be blunt, I find this very hard to believe.
> I'll just be blunt, I find this very hard to believe.
Email was the primary contact mechanism listed in the SECURITY.md file on GitHub. On your GitHub profile, you have listed links to socials (Mastodon/Bluesky/Twitter), your e-mail address, your personal website, and a video game website.
Messaging or tagging you there about an unpatched RCE would have effectively been a public zero-day disclosure, which we strictly wanted to avoid.
> Did you instruct other people not to use it within rocks.nvim?
That, too, would have been a public disclosure. All we knew at the time was that there appeared to be a second security researcher testing your site. In such situations, when there exists no perfect way to handle things, it's better not to "drop everything and panic", and to attempt *private* outreach via *defined* channels.
> statements like that make it hard for me to give you the benefit of the doubt regarding your attempts to contact me.
Rather than going back and forth on motives, how about we focus on establishing a clearer direct line of communication for the future?
> specifically the actual exploitation on the production server
Since I did not conduct the research myself, I am not in a position to comment on the technical details of it.
Much appreciated
> Messaging or tagging you there about an unpatched RCE would have effectively been a public zero-day disclosure, which we strictly wanted to avoid.
No one is saying that, huh? Are we following the same timeline? At this point you have emails out to me a Hisham. You aren't hearing back from us, it's been a while. The issue seems pretty bad. Any way of nudging either of us to check, "Hey, something important about LuaRocks, check your email" in a dm, or a message to anyone else related to LuaRocks. There's a million ways to get my attention without publicly disclosing the issue. Dang, even you could have sent an email.
> That, too, would have been a public disclosure.
I wasn't suggesting you publicly disclose. I'm trying to understand how you understood what was at stake. You have your own community of users with rocks.nvim consuming files through luarocks.org that would potentially be installing malware. I also asked you "Did you stop using LuaRocks?" I'm trying to assess if you just didn't see it as that severe of an issue.
Look, I fully accept your defense of "We did what was in SECURITY.md. Not our fault that the emails were never delivered. Anything else is outside our responsibility. " If you're just some random security researcher, I accept it. My argument is that you aren't a rando and you're more tied to the ecosystem, and have more responsibility. But maybe you disagree.
> Rather than going back and forth on motives, how about we focus on establishing a clearer direct line of communication for the future?
Yes, thank you! I've been waiting for email from anyone at this point. I tried to get info from Vhyrro way before this HN thread but got ignored https://github.com/vhyrro/luarocks-rce-proof-of-concept/issu...
> Since I did not conduct the research myself, I am not in a position to comment on the technical details of it.
You have enough intimate details of the situation to participate in a multi-day conversation with me on behalf of Vhyrro's work but conveniently don't know anything else? Were you a politician in another life? :)
I will follow up with your email, thanks
Sorry for all the snark, I hope you can at least empathize a little with my situation.
That is exactly what Vhyrro tried to do on Matrix. The room had active messages from July/August and no notice of departure, so we had no reason to assume it wouldn't reach you.
> or a message to anyone else related to LuaRocks
That's how we got the link to the Matrix/Gitter room in the first place.
> Were you a politician in another life?
No, but I've been told my great-great-grandad was :)
On August 7th, Vhyrro messaged me after noticing someone had uploaded malicious rockspecs, `bcrcewon-1.0.rockspec` and `7e0b94029db0`, to luarocks.org. I suggested we notify you and Hisham and gave him Hisham's e-mail address (which I had in my address book, since I had been in touch with him before and based on prior experience knew you were hard to reach). Vhyrro found your Gmail address and sent you an email on August 7th:
--- > I've noticed that somebody on luarocks.org has uploaded two potentially malicious rockspecs: [...] These two packages contain luajit bytecode instead of traditional Lua code, which means they could contain some sort of sandbox escape and could have done some damage on the actual server itself, and may be worth investigating. Coincidentally, I've been researching this exploit vector myself over the past week, but in isolation and on my local docker run of luarocks-site. It's entirely plausible that luajit bytecode has some out-of-bounds read or write which could spell trouble for the real site, which is why I am writing you with such concern. I haven't dissected the bytecode yet, and so I can't test if it works, but it might be worth preemptively rolling out a fix. Maybe a check that disallows bytecode uploads? Seeing someone attempt a similar thing on the main luarocks site is not good news, so I recommend having a look on the main server to see if anything got compromised. ---
On August 14th, Vhyrro told me he had achieved full RCE (reproduced locally on his docker instance). He spent the next day cleaning up his POC to make it consistently reproducible. On August 15th, he sent you a second follow-up email to your Gmail address. We agreed to wait for a response for 2 weeks and then look for alternate channels to reach you on. On August 16th, he told me he was considering messaging Hisham because his previous email to you about the guy pentesting your site had gone unanswered. A day later, Vhyrro again asked me if we should try reaching out to you on other channels. I urged him to give it some time because we know you & Hisham maintain LuaRocks in your free time, and we don't want to contribute to FOSS maintainer burnout.
On August 20th, we joined the official luarocks matrix room (#luarocks_luarocks:gitter.im) and found your personal Matrix handle. That's when Vhyrro DM'd you on Matrix.
Finally, on September 10th, over a month after his initial warning about the live attack and weeks after his follow-ups regarding the RCE PoC, having received no response across email or Matrix, Vhyrro submitted the report to CERT/CC.
Regarding your comment on Lux: Dismissing our work as LLM "vibe coding" (it's not) and claiming we acted out of self-interest is an unfair personal attack. We did all we could to try and warn you early while giving you enough time to address a severe issue without causing unnecessary panic.