______ _____ _   _ _____ _   _   ___  _____  _   _______ _   _ _____
| ___ \  ___| \ | |_   _| | | | / _ \/  __ \| | / /_   _| \ | |  __ \
| |_/ / |__ |  \| | | | | |_| |/ /_\ \ /  \/| |/ /  | | |  \| | |  \/
| ___ \  __|| . ` | | | |  _  ||  _  | |    |    \  | | | . ` | | __
| |_/ / |___| |\  |_| |_| | | || | | | \__/\| |\  \_| |_| |\  | |_\ \
\____/\____/\_| \_/\___/\_| |_/\_| |_/ \____/\_| \_/\___/\_| \_/\____/

$ whoami
benjamin kincses — full-stack developer & security researcher, hungary

$ cat mission.txt
find real bugs in other people's code. prove every one of them.
fix them properly, with tests. get the fix merged.

$ ./status --now
50 PRs merged in the current sprint to 100, across mypy, Home Assistant,
Payload CMS, pnpm, Medusa, prettier/plugin-php and more.
10 CVEs published on WPScan on 2026-11-09, listed below.
first paid bug bounty accepted on YesWeHack.

I spend most of my time on open source and security research. I find real bugs, fix them, and get the fixes merged. 50 merged pull requests in my current sprint toward 100, sitting in mypy, Home Assistant, Payload CMS, Medusa, pnpm, prettier plugin-php, and a long list of smaller projects. I prefer fixes with tests over drive-by changes, and I stay on a thread until the maintainer is satisfied.

Code audits and bug bounties. Active on HackerOne, Bugcrowd, Intigriti, and YesWeHack. Every finding gets a working proof of concept before it is reported. No proof, no report.

Published on WPScan, 2026-11-09: 10 CVEs in Security For WooCommerce <= 1.0.16

All 10 unauthenticated, all credited to me on WPScan, no fix available:

• CVE-2026-123696, two-factor authentication reset, CVSS 7.5
• CVE-2026-123697, two-factor code and secret disclosure, CVSS 7.5
• CVE-2026-123698, plugin settings disclosure via REST API, CVSS 5.3
• CVE-2026-123699, forced plugin, theme and core updates, CVSS 4.8
• CVE-2026-123700, mass comment deletion, CVSS 7.5
• CVE-2026-123701, plugin settings reset, CVSS 5.3
• CVE-2026-123702, wp-config keys and salts reset and denial of service, CVSS 6.5
• CVE-2026-123703, arbitrary user logout, CVSS 5.3
• CVE-2026-123704, administrator email address disclosure, CVSS 5.3
• CVE-2026-123705, server configuration information disclosure, CVSS 5.3

The same list is on my research page.

Filed GitHub security advisories:

Octopus-SI-OS

• GHSA-c558-f85p-7349, High
• GHSA-2j3j-m84x-gjfh, Moderate
• GHSA-82h9-785j-3rj4, Moderate
• GHSA-qmhj-fjrr-g529, Low
• GHSA-32mw-j8wg-r86j, Low

Nacos

• GHSA-q43p-chvx-vpx2, High, config authorization cluster
• GHSA-hm4f-5v62-vrm2, Moderate, unauthenticated gRPC lock handler
• GHSA-vffc-gmfm-fwh5, Moderate, unauthenticated admin bootstrap
• GHSA-mjpp-mhh4-69j9, High, OIDC authorization fails open
• GHSA-3qwh-8qph-35mg, High, rolling upgrade latch disables cluster auth
• GHSA-qg9f-29q9-5f9x, Moderate, cipher configs stored in plaintext

Experiential

• GHSA-3fwg-p649-gfhr, High, batch grant bypass
• GHSA-5mj6-3wwp-4627, High, budget bundle
• GHSA-8v36-qh6v-jgq4, High, capture working directory code execution
• GHSA-h5mm-j8x5-rh37, Moderate, planted .env leaks gateway key
• GHSA-g97v-p7hf-cxq6, Moderate, unauthenticated Pi agent bridge
• GHSA-p6vv-xw4p-p5vp, Low, gateway usage and metrics without auth

OpenCode

• GHSA-cvp8-pmjf-grpr, High, stored XSS on share pages
• GHSA-6cwg-8rrp-47rr, Moderate, webfetch redirect SSRF

GhidraMCP

• GHSA-77r9-34rq-86x4, High, combined advisory

Robo

• GHSA-q6qf-27wx-9gpm, High, combined advisory

• lazycommit: commit messages written from the actual diff. The clerical part of git, automated.
• ShipCheck: pre-flight checks for shipping web projects, built after one too many broken deploys.
• DepVet: dependency vetting for safer installs, built for a hackathon and kept alive after it.
• benihacking.top: my portfolio. Work history, write-ups, contact.

TypeScript and JavaScript, Python, PHP. Node.js, React, Next.js. WordPress and WooCommerce when the job calls for it. Linux, Docker, Git, GitHub Actions. Burp Suite and the usual audit tooling on the security side.

• GitHub: you are here.
• Portfolio and contact form: benihacking.top
• Writing: dev.to/benjaminkincses
• Security reports: if I filed an advisory on your project, reply on the advisory. It is the fastest route to me.