iiinova — where your digital self keeps evolving

Peter Stöckli

@ulldma.bsky.social

459 followers 266 following 24 posts

Security Researcher and Software Engineer at GitHub Security Lab

Posts Replies Media

Peter Stöckli @ulldma.bsky.social · 02/10/2026

Teaching a Chromebook how to MTE. How cool is that? (Actually, I don't know, but I'm happy!)

Linux Terminal showing output of lscpu with mte and mte3 flags highlighted.

Linux terminal showing the output of the custom mte-selftest software. Saying MTE works on this system.

000

Peter Stöckli @ulldma.bsky.social · 01/10/2026

Instructions unclear. Storing more Diesel at home.

000

Peter Stöckli @ulldma.bsky.social · 21/01/2026

Check out how my colleague Man Yue Mo and I used LLMs to triage CodeQL results. The GitHub Security Lab Taskflow Agent and the prompts we used are open source and ready to be used! github.blog/security/ai-...

Two tasks in sequential order displaying which notes are added to the general notes in each step. With the step trigger analysis the notes added are triggers, permissions and secrets among others. The second task “audit injection point” potentially adds notes such as sanitizers and checks to the notes.

020

Peter Stöckli @ulldma.bsky.social · 15/04/2025

130

Peter Stöckli @ulldma.bsky.social · 13/03/2025

In this demonstration I show the impact of CVE-2025-25291/CVE-2025-25292, an authentication bypass in ruby-saml used by high profile OSS projects such as GitLab. My team coordinated with both the ruby-saml maintainer and GitLab to get this vulnerability fixed and patches are available at gh.io/glfx

1223

Peter Stöckli @ulldma.bsky.social · 31/07/2023

Where I'll demonstrate some typical Ruby on Rails gotchas on a real project: github.blog/2023-07-28-closing-vuln… E.g. Why you shouldn't match strings with ^ and $ when using Regex in Ruby.

Screenshot: A JavaScript alert message is displayed to demonstrate that a cross-site scripting vulnerability exists. This alert was triggered when the user clicked on the “Proceed” button on a link provided by the attacker. Instead of the “malicious” attacker-supplied JavaScript URL, the user only sees what the attacker wants the user to see, in this case: a harmless link to securitylab.github.com.

031