Kernel & RTOS
Lifecycle and lock-order correctness in kernel objects, user-pointer validation at the syscall boundary, and eBPF datapath bounds.
Shipping fixes upstream
Trust boundaries,
proven in code.
Adil Alperen Çiftci · Security Engineer
I find where security invariants break in widely deployed infrastructure: kernels, container runtimes, identity systems, WAFs and protocol parsers. Then I reproduce it, fix it with a minimal patch, and land it upstream with regression tests.
10merged upstream fixes
35changes in maintainer review
34open-source projects
6security domains
AetherApple ContainerArgo CDBloodHoundCiliumCoraza WAFCycloneDX GoDefectDojoDependency-TrackFalco libsGitpayGoogle ADK for GoHashiCorp RaftHeadlampImpacketKata ContainersKeycloakNmapOPA Gatekeeper FrameworksOSV-SCALIBROWASP CRSRT-ThreadSPIREScapySemantic KernelSharpHoundSharpHoundCommonSwarmKitTraceeValueCellWalruslibcoappwntoolssrsRAN 4G
01 / About
Systems security, end to end.
I am a security engineer based in Konya and a graduate of Selçuk University. My work sits where security properties are actually enforced: lock ordering in a kernel object, the bytes a guest agent passes to a process, the issuer a certificate path is allowed to trust, the request-body budget a WAF counts.
I contribute fixes to the open-source projects that defenders and platform teams depend on, from Cilium, SPIRE and Falco to impacket, Coraza and RT-Thread.
- RoleSecurity engineer
- EducationSelçuk University
- Based inKonya, Türkiye
- LanguagesTurkish, English
- CodeC, Go, Rust, Python, Java
02 / Expertise
Six domains, one discipline.
Every area below is backed by public patches you can read, review and run.
Runtime & containers
Guest agent byte preservation, descriptor ownership, shutdown ordering and failure reporting in container and microVM runtimes.
Identity & PKI
RFC 5280 path building, CA rotation, post-quantum signatures, workload identity and Kubernetes impersonation boundaries.
Web & API security
WAF rule-engine correctness, request-body budgets, detection rules with regression tests, and server-side authorization.
Protocol parsing
Bounds and structure validation in packet, PAC and DNS parsers; state-machine integrity in NAS and CoAP block transfer.
Software supply chain
Authenticated webhooks, SBOM signature round-trips, dependency resolution in remediation, and reproducible build caches.
03 / Method
Evidence before opinion.
The same four steps on every change, whether it is a one-line bound check or a lifecycle redesign.
Reproduce
Start from a failing test or a minimal harness on the real target, never from a theory.
Name the invariant
State the property that must hold: a bound, a lock order, a state transition, an identity binding.
Minimal patch
Change the smallest surface that restores the invariant, in the project's own idiom.
Prove it
Before-fail and after-pass regression tests, full upstream CI matrix, and lab runs where hardware or kernels matter.
04 / Upstream
45 public changes. Every one links to the code.
Merged fixes first, then work currently in maintainer review. Each card opens the pull request on GitHub.
Merged
10mergedAetheraether-lang-dev/aether#3423
Enforce path length and issuer validity
Enforces RFC 5280 pathLenConstraint and intermediate validity windows, replacing first-match issuer walking with depth- and attempt-bounded backtracking path building.
mergedAetheraether-lang-dev/aether#3340
Require CA flags for chain issuers
Certificate chain verification now rejects intermediates lacking basicConstraints cA or keyUsage keyCertSign, preventing leaf certificates from acting as issuing authorities.
mergedCiliumcilium/cilium#49130
Apply BackendTLSPolicy to GRPCRoutes
Extends Gateway API BackendTLSPolicy handling to GRPCRoute backends, so gRPC upstream connections receive configured TLS validation and status reflects invalid CA references.
mergedpwntoolsGallopsled/pwntools#2780
Encoder fallback on xor helper failure
Handles None results from xor_pair and xor_key so encoder selection falls back to the next candidate instead of raising TypeError, with doctest coverage.
mergedFalco libsfalcosecurity/libs#3112
Report plugin field extraction errors
Distinguishes plugin extract_fields API failures from legitimately absent fields by logging plugin name and error, keeping extraction nonblocking and ABI-compatible.
mergedImpacketfortra/impacket#2304
Reject cyclic DNS compression pointer chains
Tracks visited pointer offsets during DNS compressed-name parsing and rejects repeated offsets, preventing unbounded recursion on multi-pointer cycles.
mergedGoogle ADK for Gogoogle/adk-go#1639
Preserve empty text on thought-signature parts
Restores empty text fields on signed parts lacking data at the request serialization boundary, keeping replayed Gemini history valid for unary, streaming and continuation requests.
mergedSPIREspiffe/spire#7303
Honor upstream X.509 chain expiry in rotation
Computes effective CA expiration from verified upstream certificate paths and uses it for rotation scheduling, SVID lifetime capping, journal persistence, and rejection of expired prepared CAs.
mergedDefectDojoDefectDojo/django-DefectDojo#15961
Finding Group list authorization visibility fix
Derives Finding Group list visibility from the registered authorization queryset tied to the owning test and product, preserving product boundaries for groups without member findings.
mergedDependency-TrackDependencyTrack/dependency-track#7323
HMAC-SHA256 signatures for webhook payloads
Adds optional HMAC-SHA256 signing over exact transmitted webhook bytes, validates non-blank secrets, and keeps secrets out of payloads and logs.
In review
35in reviewRT-ThreadRT-Thread/rt-thread#11935
Bound signalfd slots and detach listeners on close
Replaces a global signalfd index with bounded per-context slot lookup and detaches and frees notification listeners in signalfd_close to prevent stale references.
in reviewRT-ThreadRT-Thread/rt-thread#11941
Validate user buffers in terminal ioctl
Stages RT-Smart terminal ioctl arguments in kernel buffers with copy-from/to-user validation instead of passing raw user pointers to handlers.
in reviewKata Containerskata-containers/kata-containers#13933
Preserve environment variable bytes after validation
Stops trimming validated environment variables so container processes and hooks receive exactly the bytes approved by guest policy, retaining null-byte and delimiter checks.
in reviewCiliumcilium/cilium#49791
Fill tot_len in XDP FIB lookups
Populates tot_len in XDP FIB lookups so the kernel MTU check applies and oversized frames are not redirected past the egress MTU bound.
in reviewKeycloakkeycloak/keycloak#54018
Add ML-DSA signing and verification support
Adds capability-gated ML-DSA-44/65/87 JOSE signing and verification with strict AKP key validation, private-material-free key publication, and canonical thumbprints.
in reviewImpacketfortra/impacket#2352
MS-PAC buffer and structure validation
Validates PAC descriptor tables, version, buffer alignment, bounds and overlap, plus attribute, requestor SID and signature checksum lengths before slicing.
in reviewImpacketfortra/impacket#2353
Validate IPv6, BOOTP and TCP header fields
Rejects truncated or inconsistent IPv6, BOOTP and TCP fixed-header fields and slices TCP payload from the validated data offset, raising ImpactPacketException.
in reviewCoraza WAFcorazawaf/coraza#1806
Require adjacent rx prefilter trie suffixes
Restricts regex prefilter suffix extraction to literals contiguous with the concat boundary, preventing derived required strings that could cause false negatives.
in reviewCoraza WAFcorazawaf/coraza#1770
Enforce SecRequestBodyNoFilesLimit
Enforces a request-body budget excluding file payloads, counting multipart headers and field data incrementally and setting body error variables on overflow.
in reviewHeadlampkubernetes-sigs/headlamp#8158
Reject exec plugins in dynamic kubeconfigs
Rejects exec credential plugins in client-supplied dynamic cluster kubeconfigs, with defense-in-depth validation in REST config construction to prevent backend command execution.
in reviewArgo CDargoproj/argo-cd#30451
Apply project impersonation to web terminal
Applies the project destination ServiceAccount impersonation to web terminal cluster configs, so pod lookup and exec use the same Kubernetes identity as other operations.
in reviewsrsRAN 4Gsrsran/srsRAN_4G#1572
NAS integrity checks on attach and registration
Rejects plain, integrity-unverified NAS messages in the UE 4G and 5G NAS stacks once a security context is active, including on registration and attach accept transitions.
in reviewWalrusSamsung/walrus#553
Validate reference type tags in C API
Enforces WebAssembly reference kind checks at C API boundaries, rejecting non-function handles in wasm_ref_as_func and mismatched reference types in calls and callbacks.
in reviewAetheraether-lang-dev/aether#3512
Chunked fuzz target for IPC frames
Adds a chunked fuzz harness with deterministic seed corpus exercising std.ipc frame reader bounds, partial reads and timeout handling over socketpairs.
in reviewKata Containerskata-containers/kata-containers#14200
Key agent build cache on shared sources
Includes shared Rust libraries and workspace manifests in the agent build cache key so stale agent artifacts are not reused after shared crate changes.
in reviewNmapnmap/nmap#3584
Offer SHA-384 TLS signature schemes by default
Extends the NSE TLS default signature_algorithms vector with RSA and ECDSA SHA-384 entries in registry order, covered by a unit assertion on exact ordering.
in reviewlibcoapobgm/libcoap#2208
Preserve Block1 coverage across SZX changes
Tracks Block1 received ranges at the smallest SZX used, rescaling per RFC 7959 so size changes cannot mark uncovered byte ranges complete.
in reviewValueCellValueCell-ai/valuecell#638
Authenticate and mask provider configuration endpoints
Requires an authentication dependency on provider configuration GET and PUT routes and masks API keys in provider detail responses, with pytest coverage for both rules.
in reviewGitpayworknenjoy/gitpay#1635
Server-side wallet order and payout authorization
Restricts client-mutable wallet order fields, validates order ownership, and enforces idempotency, ownership and balance checks before task payout transfers are issued.
in reviewBloodHoundSpecterOps/BloodHound#3583
Patch-aware dMSA relationship derivation
Gates dMSA domain-level relationship derivation on collected domain controller build and revision data, requiring explicit attribute write access on patched or unknown environments to avoid overstated reachability.
in reviewSharpHoundSpecterOps/SharpHound#235
Collect dMSA objects and DC build data
Emits delegated managed service accounts as a typed output stream and collects domain controller CurrentBuildNumber and revision registry values, leaving default and non-DC collection unchanged.
in reviewSharpHoundCommonSpecterOps/SharpHoundCommon#321
dMSA typing and DC registry build collection
Recognizes delegated managed service account objects, resolves predecessor links, collects DC build and UBR registry values, and preserves distinct ACL relationships for superseded-account attribute writes.
in reviewOPA Gatekeeper Frameworksopen-policy-agent/frameworks#788
Validate external_data cache entries
Restricts external-data cache writes to keys actually sent in the provider request and skips caching responses carrying a system-level error.
in reviewCoraza WAFcorazawaf/coraza#1743
Validate caller-supplied transaction IDs
Replaces transaction IDs containing path separators or ASCII control bytes with generated IDs, and the concurrent audit writer rejects unsafe IDs and escapes index entries.
in reviewCoraza WAFcorazawaf/coraza#1744
Depth-first chain evaluation via evalDepth
Adds an evalDepth action that snapshots MATCHED_VAR and TX:0-9 per parent match, evaluating remaining chain links against each snapshot so only consistent paths match.
in reviewOWASP CRScoreruleset/coreruleset#4853
Detect MEMBER OF and joined JSON_EXTRACT
Extends rule 942550 to detect quoted MySQL MEMBER OF forms and keyword-joined JSON_EXTRACT surviving whitespace removal, with regression tests.
in reviewOWASP CRScoreruleset/coreruleset#4854
Detect XML external entity declarations
Adds rules 934230-934232 inspecting REQUEST_BODY for SYSTEM/PUBLIC external entity and external DOCTYPE declarations across paranoia levels, with regression tests.
in reviewHashiCorp Rafthashicorp/raft#720
Wait for in-flight heartbeats on shutdown
Adds a heartbeat gate so Shutdown waits for in-flight fast-path heartbeats, preventing durable storage writes after the caller closes its store.
in reviewSwarmKitmoby/swarmkit#3298
Respect stop grace period in stop-first updates
Bounds the stop-first update delay by the old task's StopGracePeriod so replacement tasks do not start while the old container is still stopping.
in reviewApple Containerapple/container#2300
Stream cluster bootstrap payloads over stdin
Streams cluster bootstrap payloads over process stdin instead of shell heredocs, with concurrent draining and explicit descriptor ownership and close-on-failure lifecycle.
in reviewTraceeaquasecurity/tracee#5379
Event for read-only mount write denials
Adds an eBPF event correlating EROFS returns from mount-write checks with the kernel-owned filename, capturing write opens denied before the LSM hook runs.
in reviewSemantic Kernelmicrosoft/semantic-kernel#14466
Validate complex kernel function arguments
Validates generic and union-annotated kernel function parameters with Pydantic TypeAdapter so comma-containing annotations no longer skip argument parsing.
in reviewScapysecdev/scapy#5191
Include encapsulated padding in UDP checksum
Computes UDP checksums over the full declared UDP length, including inner padding of encapsulated frames.
in reviewOSV-SCALIBRgoogle/osv-scalibr#2446
Resolve property-backed Maven coordinates in remediation
Resolves property-backed Maven groupId and artifactId through the effective model so guided remediation matches dependencies correctly instead of falling back to dependency management.
in reviewCycloneDX GoCycloneDX/cyclonedx-go#295
Preserve JSF signatures in JSON
Adds custom JSON serialization so inline, multi-signer and certificate-chain JSF signatures survive round-trips and promoted signer field access no longer panics.
05 / Research
Labs and verification tooling.
Open-source projects for measuring detections, protocol conformance and runtime provenance in isolated environments.
HTML
Microsoft Identity Protocol Invariants
Deterministic, typed checks of Microsoft identity protocol requirements (OAuth token exchange, OIDC, MS-PAC, dMSA/Kerberos) with bounded observations from an isolated Windows Server 2025 lab.
- 37 source-linked invariants and 112 normalized evidence records
- 208 test cases: 155 Python and 53 Pester
- Four evidence classes, from spec oracles to lab observations
- Bounded MS-PAC parser and typed OAuth/OIDC/JWT oracles
RangeForge
Detection engineering lab on Hyper-V that measures Sigma rule ATT&CK coverage on real host telemetry and benchmarks LLM alert triage. Defensive only.
- Normalizes EVTX and live host events to OCSF
- Compiles Sigma rules into Python predicates
- Builds an ATT&CK coverage heat-map and reports noisy rules
- Benchmarks LLM SOC-analyst triage of generated alerts
Runtime Provenance Firewall
Research prototype correlating cgroup-scoped eBPF runtime evidence with artifact digests, SLSA provenance and in-toto Runtime Trace statements to return ALLOW, REVIEW or REJECT.
- Linux BPF CO-RE sensor scoped to a target cgroup
- Known event loss can never produce an ALLOW verdict
- Checks identity and digest equality across provenance and traces
- Documents limitations: does not establish a trusted host
Agent Boundary
Local policy engine that turns versioned AI-agent and MCP tool-call events into allow, review or deny decisions, with redacted evidence kept in a hash-chained ledger.
- Detects secret-like values in tool-call arguments
- Flags HTTP destinations that are not structurally approved
- Redacts secrets before writing evidence to the ledger
- Hash chain detects ledger modification or reordering
Enterprise Purple Range
Isolated enterprise lab that normalizes and correlates Windows endpoint and network evidence across authorized experiments using an evidence graph; identity-plane correlation is not yet validated.
- Versioned authorization manifest and fixed-command runners
- Missing evidence yields INCOMPLETE or NOT_EVALUABLE, never clean
- Correlates Sysmon events with network captures
- Runs against an isolated Active Directory domain with a domain controller and a Windows 11 endpoint
Adversary Validation Range
Isolated, manifest-authorized range that checks whether detections can tell captured evidence of controlled actions apart from benign baselines.
- Digest-pinned Docker range plus a VirtualBox internal network
- Suricata rule fired on the replayed PCAP, not the benign one
- Never exposes vulnerable applications to the physical LAN
- Missing EVE evidence evaluates to NOT_EVALUABLE
CPS Process-Integrity Harness
Deterministic, socketless CPS/OT harness that simulates PLC and HMI state in memory and measures how detectors respond to synthetic process events.
- Cannot connect to OpenPLC or physical controllers
- Zoned enterprise/DMZ/OT topology that denies traffic by default
- Seeded first-order-lag rotor model with bounded noise
- Emits sanitized JSONL for detector experiments
06 / Lab
Where the fixes get proven.
Changes are verified on real targets in an isolated environment before they reach a maintainer.
Isolated Hyper-V rangeSegmented virtual networks for reproducible experiments with no path to production systems.
Windows Server 2025 domainActive Directory lab for Kerberos, PAC and dMSA conformance checks with sealed evidence ledgers.
Linux build hostUbuntu 24.04 with aarch64 cross toolchains and QEMU for RT-Thread Smart kernel builds and utest runs.
Upstream CI on forksProject CI matrices replayed on forks so maintainers get green evidence before they spend review time.
07 / Contact
Let's talk security engineering.
Security reviews, upstream fixes, detection engineering and verification work. For project-specific questions, the relevant issue or pull request is the fastest path.