neekolas

Nick's Guide To AI Assisted Security Audits (October 2026 Edition)

It's a scary time to be an open source software maintainer. I thought I would share my overall setup and workflow for finding vulnerabilities in OSS I am responsible for.

This isn't a single skill, since it involves many models/providers inside and outside of a sandboxed environment. Some steps will only work with Daybreak/CVP enabled or an abliterated model and some will work better with Daybreak turned off. If you point your LLM at this file, you can probably turn it into a less manual workflow around your particular setup.

This process is not meant to be token-efficient or fast. It is meant to find all the vulnerabilities today's frontier tools are capable of finding. I use this process before major releases, with a much lighter and more automation-friendly process for PR checks and periodic audits.

0: Setup

neekolas

#!/bin/bash
set -eou pipefail

echo "========================================="
echo "  libxmtp Ubuntu Dev Environment Setup"
echo "========================================="
echo ""

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(dirname "$SCRIPT_DIR")"

neekolas

Keybase proof

I hereby claim:

• I am neekolas on github.
• I am molnar (https://keybase.io/molnar) on keybase.
• I have a public key ASDyeqsxnx4yqZ14kCZqeLP30e4uOIHGCbezQtz3SP4h2go

To claim this, I am signing this object:

neekolas

module.exports = function wrapHook(fn) {
    return function(user, ctx, cb) {
        Promise.resolve(fn(user, ctx)).then(val => {
            console.log('DONE with value', val)
            cb(null, val)
        }).catch(err => {
            console.log('ERROR', err)
            cb(err, null)
        })
    }

neekolas

const ts = require("typescript");
const crypto = require("crypto");

const compilerOptions = {
  module: ts.ModuleKind.CommonJS,
  lib: ["es2017", "esnext", "esnext.asynciterable"],
  target: ts.ScriptTarget.ES2016,

};

neekolas

def find_longest_substring(text, m=2):
    seen = {}
    longest = m
    start = 0
    num_distinct_chars = 0
    # Get both the index and value
    for i, curr in enumerate(text):
        if not seen.get(curr, 0):
            num_distinct_chars += 1
            seen[curr] = 1

neekolas

{
  "openapi": "3.0.0",
  "servers": [
    {
      "url": "https://slack.com/api"
    }
  ],
  "externalDocs": {
    "description": "Learn more about the Slack Web API",
    "url": "https://api.slack.com/web"

neekolas

const ts = require('typescript');
const crypto = require('crypto');
const scriptCache = {};
module.exports = function() {
	let originalCompiler = null;

	const tsCompiler = (script, cb) => {
		const hash = crypto
			.createHash('md5')
			.update(script)

neekolas

key: val