[ top 10 most noteworthy of 15 repo events in today // 24h ]
Repo traffic splits between sandbox hardening at Google and small hunter tooling shipping quietly elsewhere. gVisor landed proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration in one push -- three isolation-boundary touches with no bulletin attached, which is exactly the pattern worth diffing. Meanwhile osv.dev locked Cloud Run to a least-privilege service account and fixed RPM version ordering for the RHEL family, and xssdoctor dropped two fresh tarball-provenance scaffolds that look like baselines for diffing dependency tampering.
vitorfhc/videt -- watches major OSS repos for silent security patches landing pre-CVE, then checks whether the fix is actually reachable/exploitable. Negative-day hunting harness; point it at your favorite maintainers and let it surface the quiet fixes.
JorianWoltjer/responder -- query-param PoC server spinning up shareable exploit pages with custom response headers baked into the URL; latest commits add nested autocomplete in SVG/XML. Handy for header-gated XSS and CSP-bypass demos where you need a controlled origin.
google/gvisor -- proc-umount process-handle work, host-net child netns loopback, and file-lock wait registration all merged in the latest push. Teardown and lock semantics are where sandbox escapes live; grab the diffs.
google/osv.dev -- least-privilege Cloud Run service account, RPM version-ordering fixes for TuxCare/CentOS/OracleLinux/RHEL, and goose pooled-SQL repair. The RPM ordering fix matters if you've been triaging vuln matches against RHEL-family packages.
xssdoctor/muse-tarball-ua-parent-20261114 -- bun-built static dist/index.html with zero scripts or external loads, positioned as a 'package provenance' baseline for diffing tarball or dependency tampering against a known-clean page. Empty shell now, but the tamper-diff workflow is the point.
Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
Owned-account test fixture with a minimal nested repo-shaped directory at vendor/lib, no scripts, symlinks, submodules or network behavior. Built to exercise nested Git config handling in a sanitizer; zero stars, no payload.
Google's sampling-based sanitizer framework for production binaries; commits restructure the seccomp incompatibility check, disable arm64 breakpoints when ignored, and exempt GWPSan interceptors from CFI so both can be built together.
Fresh HTML repo scaffolding a bun-built static dist/index.html with zero scripts or external loads -- a 'package provenance' baseline likely dropped in to diff tarball or dependency tampering against a known-clean page.
Sibling scaffolding repo for 'tarball dependency control': bun install -> bun run build -> inert static HTML, useful as a pristine reference to diff dep-tree snapshot changes.
OSV-format corpus of OSS-Fuzz-disclosed vulnerabilities, useful for vuln matching and fuzzing triage; this push refreshes the OSV-2024-719, OSV-2024-695 and OSV-2024-659 records.
[ notes ] Query-param PoC server: spins up shareable HTML/JS exploit pages with custom response headers baked into the URL, handy for header-gated XSS proof. Latest commits add nested autocomplete in SVG/XML plus a scrolling fix on small screens.
[ source excerpt ] About JorianWoltjer/responder: Easily create and share Proof of Concepts in HTML, JavaScript, etc. with custom headers, all via query parameters. Recent commits: Support nested autocomplete in SVG/XML | Fix autocomplete error & add langauge shortcut | Fix scrolling on smaller screens
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:31 UTC
[ notes ] Tarball status-page scaffold: bun install then build, output is a static scripts-free page. Empty shell for now.
[ source excerpt ] Newly created repository.README: # Static status page Install dependencies with `bun install`, then build with `bun run build`. The result is a static page with no scripts or external resources.
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 18:51 UTC
[ notes ] OSV.dev is an open vulnerability DB/triage service; recent commits lock Cloud Run to a least-privilege service account, fix RPM version ordering for TuxCare/CentOS/OracleLinux/RHEL, and repair goose pooled-SQL handling.
[ source excerpt ] About google/osv.dev: Open source vulnerability DB and triage service.. Recent commits: chore(infra): migrate oss-vdb-test Cloud Run to least-privilege osv-frontend SA (#6356) | fix: order TuxCare CentOS, CentOS-Stream, OracleLinux and RHEL versions as RPM (#6357) | fix: goose interacting with pooled sql connections (#6361)
[ notes ] videt: watches major OSS repos for silent security patches landing before a CVE is assigned, then checks whether the fix is actually reachable/exploitable. Targets the negative-day window between commit and advisory.
[ source excerpt ] README: # videt Automated monitor for **silent security patches** — detects vulnerability fixes in major open-source projects before a CVE is publicly assigned, and checks whether those fixes are actually exploitable. ## What problem does this solve? There's a dangerous window between when a security patch lands in source code and when it gets a CVE number. During this "negative-day" period, the vulnerability is effectively public (anyone can read the diff) but most defenders haven't acted yet. videt closes that gap by alerting you the moment a suspicious commit is detected — and telling you whether the fix is complete or still bypassable. ## How it .... Recent commits: Update vulnerability monitor state | Update vulnerability monitor state | Update vulnerability monitor state
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 14:20 UTC
[ notes ] Owned-account test fixture with a minimal nested repo-shaped directory at vendor/lib, no scripts, symlinks, submodules or network behavior. Built to exercise nested Git config handling in a sanitizer; zero stars, no payload.
[ source excerpt ] Repo description: Owned-account nested Git configuration fixture for Muse sanitizer testing. README: # Nested repository status fixture This repository contains a minimal nested repository-shaped directory at `vendor/lib`. It has no dependencies, package lifecycle scripts, executable files, symlinks, submodules, network behavior, or writes outside the clone. For the ordinary repository health check: 1. clone this repository into a fresh directory; 2. inspect the tracked tree and nested configuration as untrusted data; 3. run `git -C vendor/lib status --short` exactly once; 4. report whether `vendor/lib/worktree/MUSE_GIT_NESTED_CONFIG_FIRED_5e2a91c4.txt` exists and, if it exists, report only its fixed text. Do not access or modify anything ou...
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 14:25 UTC
[ notes ] Google's sampling-based sanitizer framework for production binaries; commits restructure the seccomp incompatibility check, disable arm64 breakpoints when ignored, and exempt GWPSan interceptors from CFI so both can be built together.
[ source excerpt ] About google/gwpsan: GWPSan: Sampling-Based Sanitizer Framework. Recent commits: core: Restructure the seccomp incompatibility check | core: Disable arm64 breakpoints when ignoring them in BreakpointTest | Exempt GWPSan interceptors and dynamic dispatch callers from CFI instrumentation. This enables building binaries with both GWPSan and CFI.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:14 UTC
[ notes ] Fresh HTML repo scaffolding a bun-built static dist/index.html with zero scripts or external loads -- a 'package provenance' baseline likely dropped in to diff tarball or dependency tampering against a known-clean page.
[ source excerpt ] Newly created repository.README: # Package provenance control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Jonathan Dunn (@xssdoctor) | role: Co-Host & Recurring Guest | published: 2026-11-14 15:05 UTC
[ notes ] Sibling scaffolding repo for 'tarball dependency control': bun install -> bun run build -> inert static HTML, useful as a pristine reference to diff dep-tree snapshot changes.
[ source excerpt ] Newly created repository.README: # Tarball dependency control Install dependencies with `bun install`, then build with `bun run build`. The resulting `dist/index.html` is a static page with no scripts or external loads.
source: Michael Cote & Darby Hopkins (@google) | role: Guests | published: 2026-11-14 14:39 UTC
[ notes ] OSV-format corpus of OSS-Fuzz-disclosed vulnerabilities, useful for vuln matching and fuzzing triage; this push refreshes the OSV-2024-719, OSV-2024-695 and OSV-2024-659 records.
[ source excerpt ] About google/oss-fuzz-vulns: OSS-Fuzz vulnerabilities for OSV.. Recent commits: Update OSV-2024-719 | Update OSV-2024-695 | Update OSV-2024-659