mufeedvh
Finding six Nginx vulnerabilities with open models
The React2Shell Story
Hacking the old HackerNews codebase
Will incorporate false-positive rates into the rubric from the next run onwards.
At winfunc, we spent a lot of research time taming these models to eradicate false-positive rates (it's high!) so this does feel important enough to be documented. Thanks!
N-Day-Bench – Can LLMs find real vulnerabilities in real codebases?
N-Day-Bench tests whether frontier LLMs can find known security vulnerabilities in real repository code. Each month it pulls fresh cases from GitHub security advisories, checks out the repo at the last commit before the patch, and gives models a sandboxed bash shell to explore the codebase.Static vulnerability discovery benchmarks become outdated quickly. Cases leak into training data, and...
Gist: https://gist.github.com/mufeedvh/db930a423fdce8c1d8e495c7a3f...
With:
uv run mnm decompile path/to/photo.png --mode photoSharing a bit of backstory on why I decided to work on this; Firstly, “for fun” but primarily because I felt like I started losing the childlike wonder/whimsy I once had with programming.
So I started this new hobby where I ask myself “can I hack on this?” upon getting/seeing something.
For instance, I got this new Aula F75 keyboard (really good keyboard for the price btw, it sounds good too!) and it only has dedicated control software for Windows. So I downloaded the driver files, software executable, and manual sheet and reverse engineered the full protocol/packets and rebuilt it for my Mac. Then played snake with the backlights. Fun.
Anywho, happy to see my blog on the front page. Would love to hear if anyones going through something similar or working on silly little projects! :)
I made a programming language with M&Ms
How a single typo led to RCE in Firefox
The Recent 0-Days in Node.js and React Were Found by an AI
New Vulnerability in React Server Components – CVE-2026-23864
For reference:
- The Flask web framework for Python: 131880 tokens
- The Spring Framework for Java: 11070559 tokens
- Rewrite the code to another language.
- Find bugs/security vulnerabilities.
- Document the code.
- Implement new features.
You can customize the prompt template to achieve any of the desired use cases. It essentially traverses a codebase and creates a prompt with all source files combined. In short, it automates copy-pasting multiple source files into your prompt and formatting them along with letting you know how many tokens your code consumes.
Show HN: Code2prompt – Generate LLM prompts from your codebase
https://github.com/mufeedvh/code2prompt
I made code2prompt, a CLI tool to generate LLM prompts from your codebase with support for prompt templating and token counting.I initially wrote this for personal use to utilize Claude 3.0's 200K context window and it has proven to be pretty useful so I decided to open-source it. Let me know what you think.
I have plans to expand/plug this into a donation aggregator platform like you mentioned if time permits. But if there is an existing effort for the same, I am happy to contribute. :)
Nobody’s on the Ball on AGI Alignment
Security in the age of LLMs
It currently does gzip compression by default. Compression modes for specific files sounds interesting, I will definitely get around to implementing that.
Let me know your feedback/suggestions!
Show HN: Binserve – Fast single-binary static web server
I made a small CLI utility that walks your filesystem to find dependencies you use that are seeking donations.
It does so by parsing FUNDING.yml and README files which almost every project embed their support links.
It can export the list to a CSV file as well.
GitHub - https://github.com/mufeedvh/paydept
Please let me know what you think! :)
Show HN: Paydept – Shows every dependency you use that are seeking donations
All I wanted to do was write a blog but got completely distracted on choosing a static site generator or a blogging solution. I have tried some static site generators but I personally find entering the metadata section (frontmatter) for each markdown file repetitious. I have used blogspot and wordpress a lot so I am used/into writing blog into a web page (rather than a text editor) and just publishing it without thinking about files or metadata.
So I thought it would be useful to utilize Gist as it comes with a good Markdown editor, an integrated comment section, starring (bookmarking), and revisions (commits) for metadata. I didn't complete the blog but for those who actually want to write one, try out writing them via Gist.
NOTE: I hope someone who's good at CSS will contribute a better starter theme, I would really appreciate it.