Hacker News: bearsyankees

New comment by bearsyankees in "OpenAI just open-sourced Codex Security"

bearsyankees — Tue, 28 Jul 2026 21:33:37 +0000

yeah you mean because OAI is only whitebox? or expand on that a bit, haven't played around a ton w the oss codex sec

New comment by bearsyankees in "OpenAI just open-sourced Codex Security"

bearsyankees — Tue, 28 Jul 2026 21:23:16 +0000

would love it to see it h2h against https://github.com/usestrix/strix (45k stars)

New comment by bearsyankees in "We found a 1 click account takeover (and webcam access) in Granola"

bearsyankees — Tue, 28 Jul 2026 19:56:14 +0000

granola's disclosure: https://docs.granola.ai/help-center/policies/security-contri...

Finding a 1 click account takeover (and webcam access) in Granola

bearsyankees — Tue, 28 Jul 2026 19:54:57 +0000

Article URL: https://www.strix.ai/blog/granola

Comments URL: https://news.ycombinator.com/item?id=49089047

Points: 6

# Comments: 1

New comment by bearsyankees in "Granola Discloses a 1 Click Session Takeover of Its Notes App"

bearsyankees — Wed, 22 Jul 2026 14:44:48 +0000

https://www.strix.ai/blog/granola -> technical writeup

Granola Discloses a 1 Click Session Takeover of Its Notes App

bearsyankees — Wed, 22 Jul 2026 14:44:22 +0000

Article URL: https://docs.granola.ai/help-center/policies/security-contributions/desktop-app-navigation-vulnerability

Comments URL: https://news.ycombinator.com/item?id=49007641

Points: 3

# Comments: 1

One Click Account Takeover in Granola AI Notetaker

bearsyankees — Tue, 21 Jul 2026 15:14:16 +0000

Article URL: https://www.strix.ai/blog/granola

Comments URL: https://news.ycombinator.com/item?id=48993371

Points: 7

# Comments: 0

CVE-2026-59208: Cross-Issuer Account Takeover in n8n

bearsyankees — Wed, 15 Jul 2026 14:30:07 +0000

Article URL: https://www.strix.ai/blog/n8n-cross-issuer-account-takeover

Comments URL: https://news.ycombinator.com/item?id=48921422

Points: 20

# Comments: 10

New comment by bearsyankees in "Securing a DoD Contractor: Finding a Multi-Tenant Authorization Vulnerability"

bearsyankees — Mon, 04 May 2026 19:10:49 +0000

oh apologies, thanks for the reminder

New comment by bearsyankees in "U.S. military data left exposed at an a16z startup for 150 days"

bearsyankees — Mon, 04 May 2026 18:31:20 +0000

appreciate the feedback!!

New comment by bearsyankees in "U.S. military data left exposed at an a16z startup for 150 days"

bearsyankees — Mon, 04 May 2026 18:30:00 +0000

https://x.com/strix_ai/status/2051361018450948511

New comment by bearsyankees in "Securing a DoD contractor: Finding a multi-tenant authorization vulnerability"

bearsyankees — Mon, 04 May 2026 18:28:50 +0000

fixed now

New comment by bearsyankees in "Securing a DoD contractor: Finding a multi-tenant authorization vulnerability"

bearsyankees — Mon, 04 May 2026 18:26:12 +0000

apologies, just a vc firm

Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

bearsyankees — Mon, 04 May 2026 17:46:32 +0000

Article URL: https://www.strix.ai/blog/how-strix-found-zero-auth-vulnerability-dod-backed-startup

Comments URL: https://news.ycombinator.com/item?id=48012162

Points: 221

# Comments: 101

New comment by bearsyankees in "Ask HN: Who is hiring? (May 2026)"

bearsyankees — Fri, 01 May 2026 16:56:05 +0000

Strix (strix.ai, https://github.com/usestrix/strix)| Founding Engineer | NYC/SF

We built the largest open-source AI pentesting framework — 25k GitHub stars, 80k active users, 15B LLM tokens processed daily, 1,800 pentests run per day. Two of us right now. You'd be the third.

Looking for a founding-engineer engineer who's done 0→1 before and wants to own the architecture of something already at scale. You'll touch everything — infra, product, research tooling. Python/TypeScript stack, AI-native workflows, real security problems.

Email hiring@usestrix.com — tell us something you've built and why it was hard.

Context.ai seemingly cause of Vercel breach

bearsyankees — Sun, 19 Apr 2026 21:01:37 +0000

Article URL: https://twitter.com/jaimeblascob/status/2045960143209152981

Comments URL: https://news.ycombinator.com/item?id=47827611

Points: 3

# Comments: 0

New comment by bearsyankees in "Open Source Isn't Dead. Cal.com Just Learned the Wrong Lesson"

bearsyankees — Wed, 15 Apr 2026 16:26:41 +0000

https://x.com/steipete/status/2044423791405924562 very soon it seems...

New comment by bearsyankees in "Open Source Isn't Dead"

bearsyankees — Wed, 15 Apr 2026 16:25:10 +0000

I don't know if I fully agree with this -- how many people were actually self-hosting cal infra? I def could be wrong though

New comment by bearsyankees in "Open Source Isn't Dead. Cal.com Just Learned the Wrong Lesson"

bearsyankees — Wed, 15 Apr 2026 16:24:28 +0000

+1, at this point all companies need to be continuously testing their whole stack. The dumb scanners are now a thing of the past, the second your site goes live it will get slammed by the latest AI hackers

New comment by bearsyankees in "Cal.com is going closed source"

bearsyankees — Wed, 15 Apr 2026 15:50:29 +0000

Think this is a bad, bad move...

https://news.ycombinator.com/item?id=47780712