Research(17)

Every finding goes to the maintainers first. Write-ups and CVE credits appear here only after a fix ships. Until then, a target shows up as an industry and a set of counts, not a name.

Credited CVEs

None published yet. This list moves only on disclosure.

Hunted so far

  • Payments connector for a commerce platformOpen source · Node.js · 55K lines. Two findings accepted by the engine's own verification; manual reproduction and disclosure are in progress. Named here only after a fix ships.3 scans2 completed2 in disclosure13 candidates
  • Container runtime for LinuxOpen source · Go. Scanned; no confirmed finding yet. Named here only after a fix ships.1 scan1 completed0 in disclosure2 candidates
  • Web API framework for PythonOpen source · Python. Scan ended early when the budget ran out; no confirmed finding.3 scans3 completed1 in disclosure12 candidates
  • Open-source billing and client panel for hosting providersOpen source · PHP · Laravel/Livewire. Findings accepted by the engine's own verification; manual reproduction and disclosure are in progress. Named here only after a fix ships.4 scans2 completed2 in disclosure21 candidates
  • LLM gateway and proxy serverOpen source · Python. Scan stopped before completion; no confirmed finding yet.3 scans2 completed2 in disclosure30 candidates

Numbers as of 2026-10-26.

Every completed scan

  • 2026-10-26Payments connector for a commerce platform · glm-5.3-flashanalyzed / proposed 60 / 121confirmed / cand. 1 / 1$1.00
  • 2026-10-23Container runtime for Linux · deepseek-v4.1-flashanalyzed / proposed 10 / 32confirmed / cand. 0 / 0$2.01
  • 2026-10-22Web API framework for Python · glm-5.3-flashanalyzed / proposed 45 / 197confirmed / cand. 1 / 1$1.00
  • 2026-10-22Web API framework for Python · glm-5.3-flashanalyzed / proposed 95 / 405confirmed / cand. 1 / 1$2.00
  • 2026-10-21Open-source billing and client panel for hosting providers · glm-5.3-flashanalyzed / proposed 78 / 145confirmed / cand. 2 / 3$2.00

Each row is one completed scan with its own numbers, straight from the engine log. “Proposed” is every hypothesis the hunt touched; “analyzed” excludes the ones a cheap pre-screen rejected before any code was read. Confirmed findings are in coordinated disclosure.

From hypothesis to report

  1. RefutedA second, skeptical pass cited the exact defensive code that blocks the attack. Dropped.
  2. Unverifiable: contextThe model said it could not see the code it needed, even after the files it named were loaded. Parked, never counted as safe, retried next scan.
  3. UnverifiableThe evidence loaded does not support a decision either way. Parked.
  4. CandidateThe mechanism holds on the cited lines but exploitability depends on runtime state the source cannot settle. Handed to a human with a calibrated confidence.
  5. Confirmed realSurvived adversarial refutation; reachability from an external entry point not proven.
  6. Confirmed exploitableSurvived refutation, reachable from an entry point, and the manual reproduction cites only lines that exist. Written up as a report.

Only the last two are reported. How a hypothesis gets there is in How Bakakuk refutes itself.

Where to follow