Skip to content
View GrayOM's full-sized avatar
🏠
Working from home
🏠
Working from home

Sponsors

@supertokens

Block or report GrayOM

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
GrayOM/README.md

Hi, I'm GrayOM πŸ‘‹

Vulnerability Assessment Β· finding, proving and helping fix real security weaknesses


Published CVEs Credited findings Bug bounties In coordinated disclosure

Contact


I work in vulnerability assessment: finding real security weaknesses, proving them, and helping vendors fix them. My methods and tooling get better every day, and every finding below was confirmed by the vendor.

πŸ” Published findings β€” CVEs & credits

Project Finding Severity Reference
frain-dev/convoy Insecure Direct Object Reference (IDOR) High CVE-2026-81505 Β· GHSA-p5vg-v7mj-f6q4
Swetrix/swetrix Server-Side Request Forgery (SSRF) High CVE-2026-81506 Β· GHSA-fcm9-fvcm-3p55
NangoHQ/nango SQL Injection High GHSA-8m28-9wcj-v8ww
teableio/teable SQL Injection High GHSA-gj7m-w85q-hrj7
teableio/teable Broken Access Control High GHSA-2333-p777-m9ww (co-reported)
supertokens/supertokens-node Path Confusion Medium GHSA-46hr-c4pm-7mx5
chatwoot/chatwoot Cross-Account Authorization Bypass (IDOR via source_id) Low CVE-2026-115725 Β· VulnCheck advisory (VulnCheck CNA)

πŸ’° Bug bounties

Findings the vendor rewarded at its own discretion. Amounts are not listed.

Project Finding Severity Reference
ubicloud/ubicloud Information Disclosure Low #6399 Β· #6407
strangerstudios/paid-memberships-pro Sensitive File Exposure Medium 3.8.8 release Β· #3847
Countly/countly-server Unauthenticated Stored Prototype Pollution High GHSA-p78q-3v9r-c8qg
supertokens/supertokens-core App-scoped API key takes over sibling applications Critical GHSA-4rf2-xqvf-8rcx

⏳ In coordinated disclosure

5 more findings have been confirmed by their vendors and are waiting for publication. Details will appear here once each vendor publishes.

πŸ› οΈ How I work

πŸ” Every file, not a sample
Most AI-agent audits read only part of a codebase, typically the files that look most important. My review runs an exhaustive chain that covers every file of the project, so issues outside the "core" are not missed.

🧩 A 14-stage review chain
Each project goes through a fixed sequence of stages, and each stage hands its results to the next: from running the software and measuring what each kind of user can reach, through full-tree analysis, to the final verified report.

πŸ“Έ Reproduced before reported
Nothing is reported until it has been reproduced and captured on screen. That keeps false positives rare, and every report comes with a working reproduction, a negative control and the exact code path.

πŸ” Patch re-testing, private by default
I re-test the vendor's patch before it ships and report it when the fix is incomplete. Nothing is published until the vendor is ready.

πŸ“¬ Security review for your open-source project

Maintainers who want a security review of their project are welcome to reach me at tmdals7205@gmail.com. My process has a few distinctive points, and I'm happy to explain them in detail.


πŸ™ Thanks

Thank you to ubicloud, Countly and Paid Memberships Pro for supporting this research, and for working through each fix together.

Pinned Loading

  1. Agent_Guidance Agent_Guidance Public

    Python

  2. AI-Source-Vulnerability-Analyzer-ZIP- AI-Source-Vulnerability-Analyzer-ZIP- Public

    Python 1

  3. Availability-Low-Reconnaissance Availability-Low-Reconnaissance Public

    Python

  4. Fiddler_Custom_Script Fiddler_Custom_Script Public

    JavaScript