Making open source safer for everyone

pip-audit

Trail of Bits created pip-audit with support from Google, and the Python Packaging Authority now maintains it.

sigstore-rust security review

We reviewed Sigstore's Rust client over 3.5 weeks for The Sigstore Project.

Package managers have an integrity problem

We tested 25 popular package managers. Only two verified the integrity of every package they downloaded.

Full YAML anchor support in zizmor

We improved zizmor's static analysis of GitHub Actions and tested it against 41,253 existing workflows. The Sovereign Tech Agency funded this work.

Auditing RubyGems.org

We assessed the security of RubyGems.org, the Ruby ecosystem's central package repository, for Ruby Central.

Build provenance for Homebrew

Working with Alpha-Omega and OpenSSF, we added build provenance to homebrew-core, so every CI-built bottle has an attestation that users can check with brew verify.

PyTorch ExecuTorch security review

We spent nine weeks reviewing PyTorch's on-device inference runtime in an audit funded by OSTIF.

Fickling's new ML pickle file scanner

Fickling now includes an allowlist-based scanner that blocks malicious pickle files before a model is loaded.

Weaponizing image scaling against AI systems

We showed how image scaling can be used for prompt injection against production AI systems, and released the Anamorpher tool.

mcp-context-protector

mcp-context-protector is a security wrapper that protects MCP apps from line-jumping and ANSI escape-sequence prompt injection.

Auditing Gradio 5

We reviewed the security of Gradio, Hugging Face's open-source ML interface framework, before its version 5 release.

Verifying the integrity of Signal chats

We built and operate one of three independent auditors for Signal's key transparency.

Timing side channel fixed in RustCrypto ML-DSA

Our constant-time-analysis skill found a timing side channel in ML-DSA signing, and the fix was merged upstream.

Constant-time support for LLVM

We proposed an LLVM RFC and __builtin_ct_select intrinsics that prevent compiler optimizations from removing side-channel protections in cryptographic code.

We found cryptography bugs in the elliptic library using Wycheproof

Testing with Wycheproof found CVE-2024-48949 and CVE-2024-48948 in elliptic, a widely used JavaScript elliptic-curve library.

Post-quantum Go libraries

We released ML-DSA and SLH-DSA implementations in Go, designed to avoid side-channel leaks.

Go standard library cryptography review

We reviewed the cryptography packages in Go's standard library over 12 weeks for Google, and the Go team announced the results on the Go blog.

Wikimedia OATHAuth review

We reviewed the security of MediaWiki's two-factor authentication module for the Wikimedia Foundation.

gosentry

gosentry is a fork of the Go toolchain that adds LibAFL-based fuzzing to go test -fuzz.

Don't recurse on untrusted input

A CodeQL query found DoS bugs in protobuf-java (CVE-2024-7254), XStream and others.

Rust compiler and rust-clippy

We contributed lint fixes and replacement suggestions to rust-clippy, and extended rustc's QueryStability lint to detect nondeterminism.

Ruzzy

Ruzzy is a coverage-guided fuzzer for Ruby, and OSS-Fuzz now supports it.

Building Secure Contracts

Building Secure Contracts is our guide to best practices and patterns for secure smart-contract development.

go-panikint

go-panikint is a modified Go compiler that detects silent integer overflows, and it found one in Cosmos SDK's RPC pagination.

Finding mispriced opcodes with fuzzing

We built a LibAFL harness for the Fuel VM that found opcodes charging too little gas.

mquire

mquire queries Linux memory snapshots over SQL without needing external debug symbols.

LUKS2 flaws in confidential VMs

We disclosed CVE-2025-59054 and CVE-2025-58356 in LUKS2 disk encryption as used by confidential VMs.

pwndbg on LLDB

We ported pwndbg to LLDB and added Binary Ninja integration and support for embedded devices.