Skip to content
View WRG-11's full-sized avatar
🎯
Focusing
🎯
Focusing
5 followers · 4 following

Achievements

Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pull Sharkx3Achievement: YOLOAchievement: Quickdraw

Block or report WRG-11

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
WRG-11/README.md

WinstonRedGuard (WRG-11)

Solo security researcher. I report authorization bugs in open-source software and build AI/LLM security tooling and detection rules.

Published advisories

Credited reporter on four published GitHub Security Advisories:

Advisory Finding Weakness Severity Published
GHSA-wc96-jm46-37hh OneUptime: Verification-code resend lacks an ownership check CWE-862 Low Aug 2026
GHSA-9xwv-p7r5-5h5p
CVE-2026-107854		 Jexactyl: Free-billing flow lacks an ownership check CWE-639 Medium Jul 2026
GHSA-43h8-3896-wqv5 Pelican: Application API mounts bypass the ACL scope CWE-862 Medium Jul 2026
GHSA-4wxv-r46p-w2f9 Pelican: Bulk suspend and unsuspend actions lack authorization CWE-862 Medium Jul 2026

The OneUptime finding is in incoming call numbers, the sibling channel that the CVE-2026-30959 fix sweep left uncovered.

Vendor security acknowledgement: zn (local security layer for coding agents), SEC-2026-01, a high-severity control-plane authorization gap where missing function-level checks let non-admin tenant keys modify policy or consensus state. Credited on the usezn.com Security Hall of Fame.

Merged upstream

Detection templates merged into projectdiscovery/nuclei-templates:

Pull request CVE Target Merged
#16345 CVE-2026-31831 Tautulli ≤ 2.16.1, unauthenticated path traversal Jul 2026
#16335 CVE-2026-33476 SiYuan ≤ v3.6.1 Jun 2026
#16333 CVE-2026-26190 Milvus, unauthenticated metrics port Jun 2026
#16346 CVE-2026-25527 changedetection.io ≤ 0.52.9 Jun 2026

Open source

The pinned repositories below include wrg-sigma-rules (294 Sigma rules across 16 ATT&CK tactic categories, none marked stable) and mcp-objauthz-lab, a vulnerable-by-design MCP server for learning object-level and cross-tenant authorization bugs (BOLA/IDOR). desktop-automation-mcp is Apache-2.0; the others are MIT.

Pinned Loading

  1. devguard-scan devguard-scan Public

    Secret scanner that runs in your browser and in CI from the same scan.js. Paste code or drop files and it reports leaked API keys, tokens and private-key blocks, with the value redacted; nothing is…

    JavaScript

  2. wrg-sigma-rules wrg-sigma-rules Public

    Sigma rules for ransomware, threat actors and vulnerabilities disclosed in AI/LLM apps and MCP servers, with multi-backend conversion and an MCP server for Claude Code, Codex and Cursor. CI-pinned …

    Python 2

  3. ai-security-toolkit ai-security-toolkit Public

    Offensive & defensive AI/LLM security tools, labs, CTF writeups, and research. Zero-dependency Python toolkit.

    Python 1

  4. mcp-objauthz-lab mcp-objauthz-lab Public

    Vulnerable-by-design MCP server for learning object-level / cross-tenant authorization (BOLA/IDOR) bugs, plus Semgrep rules that find the same shapes in JavaScript/TypeScript, Python, Go, Rust, Jav…

    JavaScript

  5. osint-trust-envelope osint-trust-envelope Public

    Per-source epistemic ceilings for OSINT results: wrap any lookup in an honest trust envelope (verified/inferred/heuristic/unverified). Zero-dependency Python.

    Python

  6. desktop-automation-mcp desktop-automation-mcp Public

    MCP server that operates only the Windows application windows named in a policy file, and refuses everything else.

    Python