Skip to main content

Acknowledgements

People who found something we missed.

Every entry names what was reported, and what changed because of it. A page that lists names without outcomes is a thank-you note; this is a record.

We do not operate a paid programme. What we offer is stated in the disclosure policy: acknowledgement from a person, public credit under the name you choose, a written letter on request, and the remediation told to you before it is public.

2026

Gaurav Kumar@gdattacker
August 2026 · supply chain
Identified that a package namespace referenced in our published documentation had not been reserved on a public registry, so code published by a third party could have executed on the machine of anyone following our instructions.
Reproduced and confirmed. Seventeen surfaces referenced the affected name. The namespace is reserved, registry resolution pinned, and install-time scripts disabled in the build pipeline. His report also prompted a review that found related issues he did not report, and two assertions now exist that would have caught this class before he did.
Reporter, name withheld pending their preference
August 2026 · audit chain integrity
Demonstrated that an exported audit chain used a 32-bit non-cryptographic hash while the surrounding interface described SHA-256 with external anchoring, so an exported chain could be edited and recomputed to pass its own documented continuity check.
Reproduced and confirmed, including six hash collisions in 200,000 samples. The export now uses SHA-256, and every claim about Merkle rooting and anchoring was corrected across seventeen surfaces to describe what the code does. The manifest had labelled the algorithm a third way again, matching neither. If you are the reporter, tell us how you would like to be credited.

How to be on this page

Report to Founder@AssetShopEnterprise.com. Read the policy first; it is short and it states what is not offered as plainly as what is.

Findings about our claims are as welcome as findings about our code. Both reports above found the same thing in different places: a statement published ahead of the thing it described. If you find another, that is a security finding here.

Entries appear on or after the disclosure date agreed with each reporter, never before. Where a reporter asked to remain anonymous or unnamed, the finding is recorded and the name is not.