Vulnerability research and reverse engineering across open-source developer tooling, Windows, and Android. I turn real defects into fixed, credited disclosures — reported through proper channels, patches pushed upstream.

📫 conner.webber000@gmail.com

_{CVE IDs are issued by GitHub after a compliance review of the published advisory, on their own schedule — CVE-2026-73222 was assigned four weeks after publication. The remaining advisories are in that queue. Further reports are in coordinated disclosure and will be listed here once published.}

Defects found, reported, and fixed upstream — credited by maintainers via commit, PR, or issue. The reporting channel differs from the advisories above; the work does not.

• libpqc-dyber (Dyber, post-quantum cryptography) — an ongoing engagement that produced the project's 0.2.0 security release. Reported an FN-DSA / Falcon BerExp sampler precision violation (the exp(-x) approximation fell below the ~2⁻⁴⁰ Rényi-divergence floor the security proof requires) (b012e00), then a second round across the remaining algorithm families — heap overflows in signing, XMSS one-time-key reuse, LMS signatures not actually verifying, and KEM oracles (ab8614b). 15 commits in the project's history carry Reported-by: Conner (Spartan8806). I also withdrew one finding of my own after re-testing it at runtime rather than from the packing arithmetic.
• leancrypto (Stephan Mueller — lean post-quantum crypto library for bare-metal and Linux kernel use) — two ASN.1 findings fixed upstream, both crediting me in the commit trailer: memory leaks in the error paths of six key-parsing modules across ML-DSA, ML-DSA+Ed25519/Ed448, Ed25519, Ed448 and SLH-DSA (6581568), and certificate path-length constraint enforcement brought in line with RFC 5280 §4.2.1.9 — pathLenConstraint was not being applied as the spec defines it, so a chain could exceed the depth an intermediate CA was authorised for (12cc2aea, shipped with a new test-certificate matrix).
• falcon-rust — beyond the advisory above, I authored both sampler fixes and am listed among the repo's contributors: the Gaussian acceptance-probability fix (930d766), and a follow-up after re-checking the first fix against the specification and finding the sampler center still short of Falcon's precision bound — moving ffSampling to FixedPoint128 (fc60813).
• PyJWT — flagged that HMACAlgorithm.prepare_key accepted empty HMAC keys with only a warning. Fixed in 2.13.0, which credits the report in the release commit: "Hardening prompted by reports from @SnailSploit and @spartan8806." That release has since propagated into the dependency history of 90+ downstream repositories, including Microsoft, Sentry, Apache, PyTorch, Canonical, Bazel and Red Hat projects.
• libE57Format (ASTM E57 3D point-cloud library, used across surveying, BIM and robotics) — found an out-of-bounds read in BufferView::read: CheckedFile requests a full physical page regardless of how many bytes remain, so a short in-memory buffer reads past its allocation. Reproduced under AddressSanitizer against a clean checkout, and verified the patched build throws instead. Fix merged as PR #352 (0e1d480); the maintainer added a regression test adapted from my reproducer. Reported privately first; the maintainer assessed it as a plain bug rather than a security issue and I agreed with that call.
• wigolo (KnockOutEZ — local-first web-fetch MCP for AI agents) — hardened an SSRF fetch path against DNS-rebinding / TOCTOU via fetch-time address resolution; fix merged (PR #210).
• enc_rust — ML-KEM decapsulation was missing Fujisaki–Okamoto implicit rejection; fix authored and merged (572a37f).
• whois (richardpenman) — SSRF referral filtering and a follow-up hardening fix, both merged (#319, #321).
• hermes-agent (Nous Research) — hardened the auto-approve edit gate against a multi-file patch bypass; fix + regression tests submitted (PR #63438).
• redis-py — plaintext password disclosure via ConnectionPool.__repr__ (CWE-532); fixed (#3993).
• tomlkit — uncontrolled-recursion DoS in parser.py (CWE-674); fixed (#459).

• Android / Pixel — vulnerability research submitted to Google's Android & Devices VRP (Buganizer): firmware reverse engineering, kernel/driver, and device trust-boundary work.
• Windows — local privilege escalation and kernel/driver research (MSRC; ZDI pipeline).
• Focus areas — memory corruption, TOCTOU / logic flaws, cryptanalysis, firmware RE.

_{Disclosure done cleanly: reported privately where a channel exists, fixes contributed upstream, no public 0-day drops. Additional reports are in coordinated disclosure and are not listed until a maintainer publishes.}