Jeff Larson

Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.

@thejefflarson20

Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...

@thejefflarson20

Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...

@thejefflarson20

Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce.

@thejefflarson20

Detects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD...

@thejefflarson20

Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive...

@thejefflarson20

Detects forms and state-changing endpoints missing CSRF protection.

@thejefflarson20

Detects error handlers that leak stack traces or fail open on exception.

@thejefflarson20

Detects autonomous agents that take irreversible or high-impact actions without human approval.

@thejefflarson20

Detects file upload handlers that accept executable content or write to web- accessible paths without validation.

@thejefflarson20

Detects GraphQL schemas without depth limits, cost analysis, or introspection controls.

@thejefflarson20

Detects API keys, passwords, tokens, and credentials embedded directly in source code.

@thejefflarson20