01
Twenty
CVE-2026-27023A redirect is a new trust decision
TraceMint contribution: TraceMint — Finder
Fixed: 1.18 · Advisory published:
A contribution
worth keeping on record.
Published security work credited to TraceMint and Deniz Parlak. Each entry leads to the technical note and the original advisory, including its complete credit record.
Publicly credited contributions
10 public advisories: 8 with CVE identifiers and 2 GHSA-only records. Not a claim about the entire research portfolio or autonomous AI discovery.
02
Hoppscotch
CVE-2026-28216An object ID is not an authorization check
TraceMint contribution: TraceMint — Reporter
Fixed: 2026.2.0 · Advisory published:
03
Arcane
CVE-2026-23520When update metadata becomes executable
TraceMint contribution: Deniz Parlak — Reporter
Fixed: 1.13.0 · Advisory published:
04
Lobe Chat
CVE-2026-23522Ownership checks belong in every mutation
TraceMint contribution: Deniz Parlak — Reporter
Fixed: v2.0.0-next.193 · Advisory published:
05
BigBlueButton
CVE-2026-27736Error paths need destination validation too
TraceMint contribution: Deniz Parlak — Reporter
Fixed: 3.0.20 · Advisory published:
06
Flowise
CVE-2026-41266Public configuration needs a private-data boundary
TraceMint contribution: Deniz Parlak — Reporter
Fixed: 3.1.0 · Advisory published:
07
Directus
CVE-2026-26185Account privacy includes response timing
TraceMint contribution: Deniz Parlak — Reporter
Fixed: directus 11.14.1; @directus/api 32.2.0 · Reviewed version record · Advisory published:
08
Bagisto
CVE-2026-21447Reordering an order still requires ownership
TraceMint contribution: Deniz Parlak — Reporter
Fixed: v2.3.10 · Advisory published:
09
YOURLS
GHSA-6mp4-q625-mxjpA callback name can become executable input
TraceMint contribution: Deniz Parlak — Reporter
Fixed: 1.10.3 · Advisory published:
10
PsiTransfer
GHSA-xphh-5v4r-r3rxAn archive carries a filesystem boundary
TraceMint contribution: Deniz Parlak — Reporter
Fixed: 2.3.1 · Reviewed version record · Advisory published:
These projects are not presented as customers or partners. Human research credits are not automatically attributed to an AI model. This index shows our contributions; the original advisories carry the complete credit records.