Skip to content
View munzzyy's full-sized avatar
🎯
Focusing
🎯
Focusing
16 followers · 9 following

Achievements

Achievement: YOLOAchievement: QuickdrawAchievement: StarstruckAchievement: Pull Sharkx3Achievement: Pair Extraordinaire

Achievements

Achievement: YOLOAchievement: QuickdrawAchievement: StarstruckAchievement: Pull Sharkx3Achievement: Pair Extraordinaire

Block or report munzzyy

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
munzzyy/README.md
Cole Munz

munzzyy.dev · build log · sponsor · Munzzyy1@proton.me

I'm Cole. I work on embedded and firmware security: kernel drivers, device firmware, and the RF/SDR stack around them. I also build privacy apps, and I send fixes upstream wherever correctness matters. The interesting bugs get written up on my build log.

140+ patches merged upstream · 60+ open · 70+ projects

Android apps

No accounts and no tracking. Starling and Magpie are on F-Droid, and the rest are in review there. Tern keeps all of them up to date straight from their releases.

App What it does
Starling Location sharing for family and friends. Positions are encrypted on your phone, so the relay only ever holds ciphertext, and it deletes that after 24 hours. On F-Droid.
Tern Installs and updates apps straight from GitHub, GitLab, Codeberg and F-Droid repos, and checks who signed every file before Android sees it. Works on Android TV too.
Sepia Shows everything a photo says about you, blacks out what you choose, then re-opens its own output and checks it again.
Magpie An incident journal that still proves something months later: encrypted, hash-chained, and checkable without the app. On F-Droid.
Blot A PDF redactor that can't leave the text behind, because it never keeps the text in the first place.
Sweep A plain-language stalkerware checkup. It never says "you are safe", and a Leave fast button sits on every screen.

Tools and web apps

Project What it does
nucleus A local security console: passive recon, an authorized pentest kit, opsec checks and file scrubbing. It binds to loopback and nothing else.
tellcheck-github Flags pull requests that look AI-written and shows the signals behind every flag. A Firefox add-on.
hopandhaul Finds when flying into a cheaper hub and taking the train beats flying direct. Open it.
liftmath Gym math you can check: 1RM from any set, plate loading, Wilks, DOTS and IPF scores. Open it.
puzzlepress Seven daily puzzle games with no accounts and no ads. Play.
coacheck Reads a research-peptide certificate of analysis and does the math. A calculator, not advice.

All of it is GPL-3.0-or-later, and almost all of it runs with zero dependencies. Every repo has a CONTRIBUTING file and an open issue tracker, and munzzyy.dev has the whole set on one page.

Upstream

I'm one of the ten people with code in the Flipper One's MCU firmware before the device ships, with more fixes in its Linux kernel, U-Boot, debug probe, corelibs and docs. Mainline U-Boot carries three btrfs patches of mine, reviewed by a btrfs maintainer, and the Rockchip tree took a two-patch SPI series for devices with no wire in one direction. GNU cpio fixed a stack overread in its tar parser that I reported with a repro and a patch; a plain cpio -itv could hit it. The rest is memory-safety and correctness work in YARA, osquery, proxmark3, rtl_433, gpac, libevpl and Monero, and fixes in privacy tools like Orbot, ProofMode, mat2 and OONI Probe.

Everything merged

BUSY Bar

The BUSY Bar shipped in July 2026, so the firmware is young and the bugs are still live. Three I found went upstream together in busy-app/busybar-firmware #905, which the team wrote themselves from my reports and patches:

Change How it got there
A zero-size allocation in the JS runner, where furi_check turns malloc(0) into a reboot, so console.log("") restarts the device reported and patched in #903, reimplemented by the team
An error string in the HTTP display API leaked on the success path reported and patched in #904, reimplemented by the team
A missing union tag in the draw API reported privately to their security address, fixed in the same PR

Also traced why pip install busylib used to hand you a version that refused to talk to current firmware: 1.1.0 and 1.2.0 were tagged on GitHub but never published to PyPI, so pip could only reach 1.0.0. Fixed upstream since; current releases publish cleanly.

Security, firmware and RF

Repo Change
u-boot/custodians/u-boot-rockchip Support SPI devices with no wire in one direction: a two-patch series applied for the 2027.01 cycle, written for the Flipper One's display bus, where the missing MISO pin doubles as the end-of-frame GPIO
GNU cpio Stack out-of-bounds read parsing unterminated tar uname/gname fields, reachable from cpio -itv; reported with a repro and patch, fixed upstream by the maintainer
flipperdevices/flipper-linux-kernel Add the missing cache hierarchy to the RK3576 CPU nodes, so Linux stops reporting the Flipper One with no caches
flipperdevices/flipper-linux-kernel Register the Flipper One's side-button interrupt in the MCU MFD driver
flipperdevices/flipper-linux-kernel Wire the Type-C up port's VBUS supply to the connector so the USB mux can actually switch it
flipperdevices/flipper-linux-kernel Stop dwc3 returning an error when a gadget dequeues a request that already completed; the same patch is on the linux-usb list for mainline
u-boot/u-boot Report file sizes from btrfs readdir, with a path-release fix and a shared size helper: three patches in mainline U-Boot, reviewed by a btrfs maintainer
flipperdevices/u-boot Fix btrfs zstd decompression of compressed inline extents, applied from my mainline U-Boot patch
flipperdevices/flipperzero-firmware Initialize timings_cnt on infrared decoder alloc and fix its bounds check
flipperdevices/flipperzero-firmware Check the NFC poller error before reading a FeliCa system-code response
flipperdevices/flipperzero-firmware NUL-terminate the PAC/Stanley card id before parsing it
flipperdevices/flipperzero-firmware Fix the trailing Wiegand parity bit on Pyramid LFRFID cards
flipperdevices/flipperone-mcu-firmware Stop the main GPIO expander's reset path using a freed handle when re-initialization fails
flipperdevices/flipperone-mcu-firmware Read Status1, not Control0, when the USB-C PD controller checks rx_empty
flipperdevices/flipperone-mcu-firmware Fail the haptic driver's auto-calibration when its status register says it failed
flipperdevices/flipperone-mcu-firmware Leave the I2C slave critical section on the early return
flipperdevices/flipperone-mcu-firmware Check for NULL before dereferencing in serial deinit
flipperdevices/flipperone-mcu-firmware Remove a double pipe_free in the CLI UART disable handler
flipperdevices/flipperone-mcu-firmware Fix a hard fault in the Flipper One CLI when USB disconnects mid-screen
flipperdevices/flipperone-mcu-firmware Stop a wild pointer reaching the Flipper One's device-info callback
flipperdevices/fbtng-corelibs Fix a use-after-free in the event loop when a run-once subscription fires
flipperdevices/fbtng-corelibs Fix an out-of-bounds read in bit_lib when the requested bits fit one byte
flipperdevices/flipperzero-good-faps Add the missing terminator to the SPI-mem chip table
VirusTotal/yara Null-terminate authenticode digest/thumbprint hex buffers
VirusTotal/yara Fix a string leak in CLI args_free
VirusTotal/yara Honor -w/--no-warnings for the file-too-large skip message
VirusTotal/yara Reject hex jump and repeat lengths that overflow an int
VirusTotal/yara Document the YR_RE_SCAN_LIMIT regular-expression scan limit
ffuf/ffuf Stop terminal control characters leaking into redirected output
gpac/gpac Fix four more strchr scan loops that read past the end of the buffer, two reachable from a crafted file, finishing a sweep upstream had started
chimera-nas/libevpl Stop the HTTP server freeing a client's in-flight request twice when the client disconnects mid-request
chimera-nas/libevpl Keep the iovec ring's waist in bounds when the ring grows
YARAHQ/yara-forge Align indexed and patterned hash meta fields
SigmaHQ/sigma Add a vmmemWSL exception to the non-existing-file rule
splunk/security_content Add a PreAuthType filter to the PetitPotam Kerberos detection
splunk/security_content Fix a wildcard declared on a column that doesn't exist in the malware user-agent lookup
openmls/openmls Sign the GroupInfo with the new key when a commit rotates the signature key, so joiners can verify it
openmls/openmls Stop FrankenProposal's length counting the proposal type twice
cake-tech/trezor-flutter Decode a THP packet that exactly fills the packet size
monero-project/monero Keep the additional-derivations list aligned when one derivation fails, so later outputs are still seen as yours
monero-project/monero Make sweep_account expand index=all against the account being swept, not the current one
monero-project/monero Clamp the export_outputs start to the transfer count so the reserve stops underflowing
monero-project/monero Stop reserve proofs counting outputs already spent by a broadcast-but-unconfirmed send, which proved reserve the wallet no longer had
osquery/osquery Scan XDG-base-directory Firefox profiles
osquery/osquery Add the Windsurf .devin path to vscode_extensions
osquery/osquery Add the Microsoft Edge and Flatpak paths to chrome_extensions on Linux
osquery/osquery Split the sudoers header on the first unescaped whitespace, so escaped spaces in a name stop leaking into the rule
osquery/osquery Fix an off-by-one bounds check in the platform_info BIOS parser
osquery/osquery Widen the mounts table's statfs block and inode counts to 64 bits, so a filesystem over 2^32 blocks stops wrapping
RfidResearchGroup/proxmark3 Fix a heap out-of-bounds read in hf iclass view on short dumps
RfidResearchGroup/proxmark3 Stop the IR56 wiegand decode leaking the header sentinel bit into the facility code
RfidResearchGroup/proxmark3 Fix byte-swapped, corrupted EM 4x05 dump files
RfidResearchGroup/proxmark3 More heap out-of-bounds reads on short iCLASS dump files
RfidResearchGroup/proxmark3 Set the stringop-overflow guard before the bundled deps are added, so the flag actually reaches them
RfidResearchGroup/proxmark3 Reject an undersized hf xerox view dump file instead of reading past the buffer
merbanan/rtl_433 Fix a uint8_t offset wraparound in the m-bus payload parser
merbanan/rtl_433 Restore a missing bitbuffer_clear in pulse_slicer_dmc
merbanan/rtl_433 Fix swapped order/inversion nibbles in the secplus_v2 docs
merbanan/rtl_433 Widen the m-bus payload offset so the AFL sub-header recursion can't wrap it

RF/SDR, privacy, accessibility, localization and health

Repo Change
f4exb/sdrangel Bump bundled faad2 to 2.10.1 to fix a heap overflow
f4exb/sdrangel Fix a crash adding a LocalSink channel with no Local Input device
UberGuidoZ/Flipper Fix dead links in the Sub-GHz docs
PentHertz/urh-ng Decode int8 samples as signed char so magnitudes stay correct on ARM
jcsteh/osara Make paste/duplicate screen-reader messages translatable
guardianproject/orbot-android Request ACCESS_LOCAL_NETWORK before opening the proxy on all interfaces
guardianproject/orbot-android Fix the Bridge.doh getter reading the dot parameter, so doh= lines parse and stop growing duplicates
guardianproject/orbot-android Fix bridge parsing for transport lines with no fingerprint
guardianproject/orbot-android Unit tests for the bridge line parser, one case per transport the app ships
guardianproject/orbot-android Normalize unicode spaces in custom bridge input
guardianproject/orbot-android Add an IPv6 preference to HTTPTunnelPort
guardianproject/orbot-android Kindness mode stopped a proxy it had already stopped, died with the process, and left stale UPnP mappings behind; closed a two-year-old battery-drain issue
guardianproject/orbot-android Register the Kindness network callback according to the Wi-Fi-only preference, so cellular users aren't stranded
guardianproject/orbot-android Stop every log line being stored twice when two start requests land in the bind window
guardianproject/proofmode-android Correct the C2PA GPS hemisphere on longitude and latitude
guardianproject/proofmode-android Correct the bitmap stride in QR code generation
guardianproject/proofmode-android Write the C2PA dc:creator as a JSON array instead of a bracketed string, so the signed CAWG metadata parses
guardianproject/proofmode-android Stop the share screen crashing when a shared media URI's read grant has expired
flipperdevices/flipperone-debug-probe Keep the DAP ring-buffer backpressure working after the pointers wrap, plus NULL handle derefs and a CDC error read as a huge length (#16, #15, #14)
flipperdevices/flipperone-docs A docs validator for fragment anchors and broken image paths, plus microSD, charger and fuel-gauge part-number fixes (#427, #422, #421)
hotosm/tasking-manager Replace Nominatim reverse geocoding with an in-database pg-nearest-city lookup
ooni/probe-cli Remove a stray debug print in the feature-flag cache
jvoisin/mat2 Strip APEv2 and ID3v1 tags that sit after the audio in mp3, ogg and flac
jvoisin/mat2 Sort OOXML attributes themselves instead of reordering elements out of schema order
jvoisin/mat2 Clean tracked moves out of docx files, which Word records as moveFrom/moveTo, not del/ins
jvoisin/mat2 Stop a bare HTML5 void element like <meta charset="utf-8"> making mat2 refuse to clean the file
symfony/symfony Fix the Finnish BIC/IBAN mismatch translation
symfony/symfony Drop an always-true method_exists check
symfony/symfony Escape backslashes in Mime's Address::getEncodedName(), so a name ending in one can't break the header quoting
symfony/symfony Fix broken placeholder translations across Armenian, Arabic, Basque, Turkish, Galician, Azerbaijani, Traditional Chinese, Finnish, and Welsh
ghostfolio/ghostfolio Improve the French localization
ghostfolio/ghostfolio Improve the Dutch localization, again later
ghostfolio/ghostfolio Fix corrupted state attributes in the Catalan and Turkish locales
jsverse/transloco Respect currency in numberFormatOptions
simonoppowa/OpenNutriTracker Catch silent zero-byte export writes
simonoppowa/OpenNutriTracker Stop stone body weights showing a full stone worth of pounds
davidhealey/waistline Guard Meals.init against overlapping calls
davidhealey/waistline Distinguish rate-limit and network errors from bad USDA keys
osquery/osquery Fix a one-past-end iterator deref in vscode_extensions
osquery/osquery Fix the wrong key_strength reported for Windows certificates
osquery/osquery Key the recursive-glob visited set on (device, inode) so symlinked trees stop being rescanned
projectdiscovery/nuclei-templates Stop nfs-v3-exposed counting a PROG_UNAVAIL reply as a hit
projectdiscovery/nuclei-templates Fix the nh-c2 DSL matcher that can never match
projectdiscovery/nuclei-templates Stop two WordPress VR XSS templates firing on any HTML page that escapes the payload
projectdiscovery/nuclei-templates Stop the HP printer default-login template matching any 200 response as a hit
monero-project/monero-gui Fix a stale subaddress selection on the Receive page after switching accounts
monero-project/monero-gui Read a restore date typed without hyphens as a date, not a block height
mdn/translated-content Correct the Japanese Reflect.deleteProperty() docs
openfoodfacts/open-prices Remove an unreachable branch in the barcode short-code fixups
openfoodfacts/open-prices Point the prediction_count__lte filter at prediction count instead of price count
openfoodfacts/robotoff Replace obsolete facet URLs with the /facets/ prefix
VirusTotal/yara Bound the tilde-stream row count in dotnet_parse_tilde_2
projectdiscovery/nuclei-templates Detect exposed ZooKeeper even when the 4lw commands are blocked
splunk/security_content Add a computer-account filter to the service-ticket detection
flipperdevices/flipperone-docs Fix broken section anchors and an image path, add a missing eSIM mention
flipperdevices/flipperone-docs Fix a mismatched M.2 thickness spec on the M.2 port page
merbanan/rtl_433 Reject out-of-range temperature and humidity in the GT-WT03 decoder
merbanan/rtl_433 Reject implausible temperature and humidity in the WT450 decoder
merbanan/rtl_433 Reject an all-zero Truck TPMS payload that passes the XOR check
flipperdevices/flipperzero-firmware Reject a zero or negative timer interval in js_event_loop
flipperdevices/flipperzero-firmware Don't read past the buffer in bit_lib when the requested bits fit one byte
flipperdevices/flipper-application-catalog Log the folder being skipped, not a leftover filename
splunk/security_content Point two LOLBin detections at a CIM field that exists, so a renamed whoami or arp stops slipping past them
ClickHouse/click-ui Respect a consumer-supplied aria-label instead of overwriting it with the icon name
FoggedLens/deflock Tell people they need an OpenStreetMap account before they pick a way to report a camera
mdn/translated-content Use a real minus sign in the BigInt operator example across the Korean, Portuguese and Russian docs
Open and in review: 66 across 45 projects

Security and detection

OSINT

  • mxrch/GHunt #601: read isDefault from the API for profile photos instead of hashing the image
  • mxrch/GHunt #602: key profile photos by their own container, not the outer loop's

RF / SDR

Flipper One (9 open): the device isn't out yet, so this is bootloader, MCU firmware, build system and docs

FreeWili 2 (1 open): the RP2350B handheld, before it ships

  • freewili/wilibsp #28: a USB wMaxPacketSize copied unbounded into a 64-byte DPRAM window, four IR decoders accepting over-long frames, a UF2 check that ignored the family ID, and signed CIC accumulators; each fix with a test that fails without it, plus the repo's first CI

Flipper Zero (6 open): firmware, apps, host tooling, and the RPC libraries

TentacleOS (4 open): firmware for the ESP32-P4 High Boy handheld

GrapheneOS (2 open): fixes in their allocator and Info app, every one reproduced before it was written

  • GrapheneOS/hardened_malloc #374: get make tidy back to green by restructuring the two remaining analyzer complaints instead of suppressing them
  • GrapheneOS/Info #132: show a translated offline message with a Retry action instead of a raw UnknownHostException toast

F-Droid

  • fdroid/fdroidserver !1863: list every certificate in a rotated app's signing lineage, so a client can match a copy signed with the old key

Accessibility

  • jcsteh/osara #1434: on the Mac, messages that carry a menu access key never find their translations, so localized menus read out in English

Privacy / anti-surveillance

Cryptography and wallets

Systems / web

Health / food

Localization

Directory listings (not fixes, just getting the tools indexed)

Support

If one of these saves you an afternoon, sponsoring is what keeps them free, and every sponsor gets a line in SUPPORTERS.md. Monero works too:

8BApLkfsBS39oNXz4L1qCmZ7f5zKVRr1qLJgrHddRZb4JRcnjDkcKdk7wW7uThCeV9CuLn8o7gAn8d6vFeWNiyeXSmrRUSq

Pinned Loading

  1. starling starling Public

    Private, end-to-end encrypted location sharing for your circle. No accounts, no tracking. Live at starlingmap.app

    JavaScript 47

  2. tern tern Public

    Installs and updates Android apps straight from their developers, and checks every file first. Phones, tablets and Android TV.

    Kotlin 10

  3. magpie magpie Public

    A journal that can prove itself. Encrypted, hash-chained incident log with self-verifying exports.

    JavaScript 7

  4. hopandhaul hopandhaul Public

    Cheapest way to travel: fly into a cheaper hub, train the rest when it beats flying direct. Click-the-map planner, pure-stdlib Python, zero deps, UI in 46 languages.

    Python 4

  5. nucleus nucleus Public

    A local, loopback-only security command center: OSINT recon, an authorized pentest kit, opsec and reporting, plus a dev toolbelt. Stdlib Python, zero deps.

    Python 3

  6. blot blot Public

    Redaction that destroys what it covers. PDFs flattened to pixels, inked, and re-checked to contain zero extractable text.

    JavaScript 1