From 7f85f5dd2034365dce12a662150a7383383bffa7 Mon Sep 17 00:00:00 2001 From: Hideaki Takahashi Date: Wed, 21 Oct 2026 17:55:40 -0400 Subject: [PATCH 1/2] Update showcase with new web applications and benchmarks --- docs/SHOWCASE.md | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/docs/SHOWCASE.md b/docs/SHOWCASE.md index c33e7ce76..56f05eb68 100644 --- a/docs/SHOWCASE.md +++ b/docs/SHOWCASE.md @@ -1,7 +1,25 @@ # Showcase -- [senv](https://github.com/h5i-dev/senv): Sandboxed Python environments, with the workflow of uv. +## Web Applications using `h5i-app` + +- [o5s](https://github.com/h5i-dev/o5s): Patch-based version control for concurrent AI agents, deployable on Cloudflare Workers. +- [h5i-db](https://github.com/Koukyosyumei/h5i-db): High-performance time-series database and backtesting engine with an `h5i-app`-based web interface. + +## Benchmarks + +- [h5i-app-bench](https://github.com/h5i-dev/h5i-app-bench): Benchmarks for formal verification coverage and web application performance across languages. +- [h5i-websec-bench](https://github.com/h5i-dev/h5i-websec-bench): AI-driven penetration testing benchmarks using public CTF challenges. + +## Third-Party Tools + - [h5i-fastapi-starter](https://github.com/SumedhAnupSupe/h5i-fastapi-starter): A small FastAPI application with a simple HTML UI, designed to run inside an h5i box. - [h5i-egress-advisor](https://github.com/AniketR10/h5i-egress-advisor): Reads a box's receipts and turns the egress its allowlist refused into `h5i box allow` lines to review — or a `[profile.X.net]` block for the tiers `h5i box allow` cannot reach. - [h5i-git-hooks](https://github.com/VedantMadane/h5i-git-hooks): Git hooks that run your test suite inside an h5i box (pre-commit on the staged tree, pre-push on the tip). - [h5i-audit-report](https://github.com/Pewpenguin/h5i-audit-report): Turns `h5i browser audit --json` into a self-contained HTML report for archiving and sharing. + +## Selected vulnerabilities found by h5i + +- [rustical GHSA-9cp5-7crm-9cf7](https://github.com/lennart-k/rustical/security/advisories/GHSA-9cp5-7crm-9cf7): Missing authorization checks allowed cross-user object deletion. +- [rustfs GHSA-9wgh-5r68-49p7](https://github.com/rustfs/rustfs/security/advisories/GHSA-9wgh-5r68-49p7): A Policy Evaluation That Could Loop Forever +- [Exograph #2320](https://github.com/exograph/exograph/issues/2320): Access-control bypass when protected fields were omitted during record creation. +- [OxiCloud #796](https://github.com/AtalayaLabs/OxiCloud/pull/796): IDOR vulnerability exposing other users' file metadata through music playlists. From 2385e0c31a5eb88f056f197c74f628a5c9ef2231 Mon Sep 17 00:00:00 2001 From: Hideaki Takahashi Date: Wed, 21 Oct 2026 17:57:42 -0400 Subject: [PATCH 2/2] Add AI Town project to showcase Added link to AI Town project rebuilt in Rust. --- docs/SHOWCASE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/SHOWCASE.md b/docs/SHOWCASE.md index 56f05eb68..c305dd600 100644 --- a/docs/SHOWCASE.md +++ b/docs/SHOWCASE.md @@ -4,6 +4,7 @@ - [o5s](https://github.com/h5i-dev/o5s): Patch-based version control for concurrent AI agents, deployable on Cloudflare Workers. - [h5i-db](https://github.com/Koukyosyumei/h5i-db): High-performance time-series database and backtesting engine with an `h5i-app`-based web interface. +- [ai-town](https://github.com/h5i-dev/ai-town-rust): [AI Town](https://github.com/a16z-infra/ai-town) rebuilt in Rust with h5i-app ## Benchmarks