Skip to content

docs: mercury GHSA-8hq5-94w5-f4ff fixed and published (28th fix) #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elfrost merged 1 commit into from
Oct 26, 2026
Merged

docs: mercury GHSA-8hq5-94w5-f4ff fixed and published (28th fix) #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions docs/fixed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
---
layout: default
title: Findings a maintainer fixed
description: "The 27 scans in the AI PatchLab series where the maintainer shipped a fix — what was reported, and what landed upstream."
description: "The 28 scans in the AI PatchLab series where the maintainer shipped a fix — what was reported, and what landed upstream."
---

# Findings a maintainer fixed

Of 114 scans, **27** ended with a maintainer shipping a fix. This page is the
Of 114 scans, **28** ended with a maintainer shipping a fix. This page is the
short version of the argument: a report is only worth writing if someone can act on it.

The fastest turnaround in the series was about six hours from filing to a merged pull
Expand All @@ -18,6 +18,7 @@ release notes.
| Date | Repository | Raw findings | Real |
|---|---|---:|---|
| 2026-09-14 | [superlinked/sie](scans/superlinked-sie.html) | 156 | 1 real |
| 2026-09-11 | [mljar/mercury](scans/mljar-mercury.html) | 140 | 1 real — withheld |
| 2026-09-03 | [samuelgursky/davinci-resolve-mcp](scans/samuelgursky-davinci-resolve-mcp.html) | 97 | 1 real |
| 2026-08-31 | [shy3130/tick-stock-panel](scans/shy3130-tick-stock-panel.html) | 77 | 1 real |
| 2026-08-29 | [ginlix-ai/LangAlpha](scans/ginlix-ai-langalpha.html) | 372 | 1 real |
Expand Down
8 changes: 4 additions & 4 deletions docs/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
layout: default
title: AI PatchLab Scans
description: "114 curated security scans of open-source AI agents, MCP servers and LLM apps - 27 confirmed fixes, run local-first with Semgrep, Gitleaks, Trivy and pip-audit."
description: "114 curated security scans of open-source AI agents, MCP servers and LLM apps - 28 confirmed fixes, run local-first with Semgrep, Gitleaks, Trivy and pip-audit."
---

# AI PatchLab Scans
Expand All @@ -20,7 +20,7 @@ remediation and confidence rules to normalize the findings.

> **Want this run privately against your own codebase?** I do independent
> security review of AI agents, MCP servers, and LLM apps —
> [**work with me →**]({{ '/work-with-me' | relative_url }}). 114 scans, 27 confirmed fixes, methodology in the open.
> [**work with me →**]({{ '/work-with-me' | relative_url }}). 114 scans, 28 confirmed fixes, methodology in the open.

> **OpenAI just launched [Daybreak](https://openai.com/index/daybreak-securing-the-world/) and Patch the Planet.**
> Same remediation loop, opposite trade-off: their path is a cloud frontier model;
Expand All @@ -35,7 +35,7 @@ remediation and confidence rules to normalize the findings.

## Two shorter ways in

- [**Findings a maintainer fixed**]({{ '/fixed' | relative_url }}) — the 27 that resolved
- [**Findings a maintainer fixed**]({{ '/fixed' | relative_url }}) — the 28 that resolved
upstream. The shortest version of the argument: a report is only worth writing if someone
can act on it.
- [**Scans that found nothing**]({{ '/clean' | relative_url }}) — 41 of them, published as
Expand Down Expand Up @@ -131,7 +131,7 @@ filed, which is the usual outcome of a clean scan.
| 2026-09-14 | [superlinked/sie](scans/superlinked-sie.html) | 156 | 1 real | **fixed** |
| 2026-09-13 | [bubbuild/bub](scans/bubbuild-bub.html) | 72 | 1 real | declined |
| 2026-09-12 | [langroid/langroid](scans/langroid-langroid.html) | 132 | 0 real | — |
| 2026-09-11 | [mljar/mercury](scans/mljar-mercury.html) | 140 | 1 real — withheld | accepted |
| 2026-09-11 | [mljar/mercury](scans/mljar-mercury.html) | 140 | 1 real — withheld | **fixed** |
| 2026-09-10 | [Datus-ai/Datus-agent](scans/datus-ai-datus-agent.html) | 291 | 1 real | open |
| 2026-09-09 | [mims-harvard/ToolUniverse](scans/mims-harvard-tooluniverse.html) | 284 | 1 real — withheld | private |
| 2026-09-08 | [chigwell/telegram-mcp](scans/chigwell-telegram-mcp.html) | 38 | 0 real | — |
Expand Down
Loading
Loading