Site information / Security
Security reporting
If you spot an issue on ZombieMutex, please tell me. The site publishes educational security content, but that doesn't mean its implementation should be treated as invulnerable.
Report a concern
Use the contact pageto describe the affected URL, expected behavior, what you observed and any reproduction details that don't expose private data. If sensitive evidence is involved, ask for a safe exchange method first. Please don't submit real passwords, tokens, exploit payloads, malware binaries or other people's information.
This is an informal responsible-disclosure contact route, not a bug-bounty program or a blanket authorization to test third-party infrastructure. Avoid destructive testing, availability attacks, and accessing accounts or data you don't own.
Contact me about securityRust and Go security implementations
I built an offline Rust ELF64 hardening inspector and a controlled Go API authorization and concurrency test harness. Both have reproducible test fixtures, public source downloads, documented limitations and no third-party scanning. The Go harness proves the vulnerable behavior first, then verifies the fixed tenant and replay boundaries.
Inspect the security tooling →Agent execution boundaries
I implemented a policy reference to inspect agent tool authorization decisions: verified workload identity, bounded delegation, cross-tenant requests, network egress and replay. Its fixtures are synthetic. A real agent requires service-side enforcement and isolation controls outside model-generated instructions.
Inspect the agent policy implementation →About the analysis and case files
Security analyses and reference implementations use documented synthetic fixtures. Malware case files summarize public reporting. The site does not offer a live malware sandbox or host executable samples. See case files,editorial standards, andprivacy controls for the relevant boundaries.