Research & writing
Security research, tool post-mortems, and threat modeling from the Hedgerow team.
Langfail: 82 Real Bugs in a Fake MLOps Platform
We built a working MLOps platform, planted 82 vulnerabilities and 50 decoys inside it, and pointed 12 scanners, LLM reviewers, and agentic pipelines at the same answer key. The best scored 57%, and nine bugs were missed by everyone — none of which contain a dangerous line of code.
Read →Closing the Seam: Cross-File Taint Analysis Without the Pro License
How we layered repository-wide, cross-file taint analysis on top of OpenGrep’s intra-file engine, so the bug that lives between two files stops being invisible. SCC-converged propagation, parameter-indexed summaries, an incremental cache, and the day the benchmark caught a zero that was impossible.
Read →“Trust Me” Is Not a Finding: The Taint Microkernel
If frontier models are this good, why build a taint engine at all? Because a model can describe a vulnerability beautifully but can’t hand you a reproducible, auditable proof. Put the deterministic engine at the center as the kernel and let the model ride shotgun as the coprocessor.
Read →How a Working Exploit Made Me Forget How to Threat Model
When your scanner is faster than your threat model. A post-mortem on submitting a high-severity RCE report, getting it closed as expected behavior, and what we actually missed in the process.
Read →No posts under that topic yet.