plzdontkillus security audit
i like pulling things apart to understand how they work. when i find something broken, i tell the people who built it. everything below was responsibly disclosed to the affected party before it was written up.
the target
plzdontkillus is an ai safety creator residency run by aella and ronny fernandez at lightcone infrastructure: a month at lighthaven in berkeley for people making work about ai risk. i audited it in may 2026, about ten hours across five phases, and reported everything before publishing anything.
i went to the residency two months later.
what came back
the interesting ones
- a chained attack combining csrf, stored xss, mass assignment and a javascript: uri
- three denial-of-service crash vectors against a single-threaded python server
- full infrastructure mapping: cloudflare to nginx to python http.server
- a write-only api with zero data leakage, which is a finding in the other direction
- 250+ tests across five phases
scope
elsewhere
in 2025 i found authentication and authorisation flaws in the order management of an e-commerce platform, little wonderland, that let an order reach the database without payment. also disclosed.
if you want me to audit something, or you think i broke something of yours and want to talk about it, reach out. i don't do this to cause harm. i do it because understanding how systems fail is the first step to making them resilient.