I work on memory safety in widely used open source code: parser fuzzing, bounds and lifetime fixes, mostly C and C++.
Fixes of mine are merged in gpac, assimp, ClickHouse, llvm-project, boost.gil, duckdb and others. Bug bounty reports are with HackerOne and ZDI; several CVE-worthy issues are currently in coordinated disclosure, so details land later.
Also build small tools around the hunting workflow, e.g. ai-contrib, machine-readable AI contribution policies for OSS repos.
Based in Germany, studying.



