I'm Matt

Security researcher, developer, and co-founder of Forces Unseen.

Projects and Tools

• doublespeak.chat: An LLM security game
• zimfw: zsh configuration framework with blazing speed
• Kubetap: kubectl plugin to proxy k8s services
• vanity-npub: fast vanity (Nostr) bech-32 npub address generator
• bcryptit: generate bcrypt strings (useful when creating bcrypt test corpus)
• githooks: a few .git/hooks I use
• adventureland-poc: a template for building an AdventureLand RPG bot using Playwright and Go
• launchpad: a Go package for interfacing with a Novation Launchpad X
• dailysuntzu: demo of small, multi-stage Docker container

🧠 Research and Disclosures

	Disclosure	CVEs
	better-auth: XSS	GHSA-9x4v-xfq5-m8x5
	Home-Assistant addon-ssh: Blueprint RCE	CVE-2021-45099
🌟	Emoji to Zero-Day: Latin Homoglyphs in Domains and Subdomains	NA, patches by Verisign and Amazon
🌟	ConnectWise Control: multiple CVEs	CVE-2019-16513, CVE-2019-16512, CVE-2019-16517, CVE-2019-15614, CVE-2019-16515
	Argo: multiple CVEs	CVE-2018-21034, CVE-2020-8828, CVE-2020-8827, CVE-2020-11576
	Harbor: SSRF	CVE-2020-13788
	Keycloak: DoS	CVE-2020-10758
	Simple: Information Disclosure	CVE-2019-8350
	CoreOS Tectonic: CVE-2018-5256	CVE-2018-5256
	Home-Assistant: information disclosure	CVE-2018-21019
	Home-Assistant: markdown injection	N/A
	Mastodon: Remote User/Server Lookup DoS	CVE-2018-21018

✉ Contact

Email: m@tthamilton.com