ccsimplyspolit@research:~$ whoami --verbose

Serhii Shunko (@ccsimplyspolit)

Independent Systems & Binary Security Researcher specializing in Model Context Protocol (MCP) security, C/C++ memory-safety and bounds verification, deep packet inspection (DPI), and structure-aware mutation fuzzing (libFuzzer, libprotobuf-mutator, ASan/UBSan). Coordinated vulnerability disclosures across leading open-source repositories and cloud runtimes. B.Sc. in Applied Mathematics & Software Engineering (Oles Honchar Dnipro National University).

GitHub: @ccsimplyspolit HackerOne: @sshunko (ID Verified • Awarded) Bugcrowd: @sshunko LinkedIn: in/sshunko X: @SergeyccShunko ORCID: 0009-0002-4183-0361 Zenodo DOI: 10.5281/zenodo.23641037 Google VRP: @sshunko CVP Verification Dossier (PDF) Contact: cc.simply.spolit@gmail.com
12
Verified GHSAs
3
CERN / Zenodo DOIs
100%
Upstream Remediation
5
Defensive Security Tools

0x00 // Maintainer-Acknowledged Coordinated Vulnerability Disclosures (12 Core GHSAs)

[CVD POLICY] All listed advisories have been formally accepted by maintainers, patched upstream, or awarded security bounties under ISO/IEC 29147 responsible disclosure standards. Zero uncoordinated 0-days are published.

0x01 // Defensive Security Tooling Repositories

DOI: 10.5281/zenodo.23641037 Python / SARIF v2.1.0

protobuf-bounds-auditor

Static security analyzer for Protocol Buffers (.proto) schemas detecting unbounded repeated fields (CWE-1284), unvalidated IEEE-754 float/double wire fields (CWE-20), recursion limits (CWE-674), and untrusted allocation lengths, with DEFINE_PROTO_FUZZER harness generation.

View Repository (GitHub) →
AI/MCP HARNESS Python / CI Passing

mcp-ssrf-auditor

Dedicated security evaluation harness for Model Context Protocol (MCP) servers testing for SSRF localhost evasion (trailing dots, octal/hex IPs, IPv6 bracket variants), path containment/LFI (CWE-22), argument injection, and tool poisoning.

View Repository (GitHub) →
MEMORY AUDITING Python / C++ Parser

c-bounds-audit-framework

Automated static audit framework for C/C++ memory bounds, struct field overflows, missing table sentinels (CWE-908), off-by-one loops, and unsafe pointer arithmetic across binary protocol implementations.

View Repository (GitHub) →
DOI: 10.5281/zenodo.23640494 Protobuf / PE32+

cs-telemetry-internals

Six technical whitepapers and static analyzer covering server-side Protocol Buffers wire input validation, IEEE-754 NaN/Inf sanitization, and relocation-masked PE32+ .text section integrity verification.

Zenodo DOI: 10.5281/zenodo.23640494 →
DOI: 10.5281/zenodo.23640496 PE32+ / Lockstep

cardinal-engine-integrity

Four architectural whitepapers and zero-dependency PE32+ static auditor covering relocation-normalized section hashing, Import Address Table (IAT) boundary validation, and classification of 4,423 deterministic simulation functions.

Zenodo DOI: 10.5281/zenodo.23640496 →

0x02 // Methodology Write-ups (Fuzzing & Memory Safety)

0x03 // Coordinated Vulnerability Disclosure (CVD) Policy & PGP Key

I adhere strictly to the ISO/IEC 29147 and ISO/IEC 30111 international standards for responsible vulnerability handling. All vulnerability reports submitted to vendors include root cause analysis, deterministic test cases or reproducers, CWE mappings, and proposed remediation patches. Maintainers are granted a default 90-day coordinated disclosure period before public advisory indexing. 

Contact Email:   cc.simply.spolit@gmail.com
PGP Fingerprint: 4E9B 81C2 D73A F055 8BE9  9913 2E14 C48F 5A72 0BD6
ORCID Identifier: https://orcid.org/0009-0002-4183-0361
HackerOne:        https://hackerone.com/sshunko
Bugcrowd:         https://bugcrowd.com/h/sshunko