👋 Hi, I’m Peter, also known as @p- or @ulldma. I’m a security researcher at the GitHub Security Lab. I started my career as a software engineer, so I know firsthand what it takes to secure applications and fix vulnerabilities. My focus is on reducing attack surfaces and eliminating entire classes of vulnerabilities, with a particular interest in authentication protocol implementations and deserialization.

Since early 2025, our team has been working on the GitHub Security Lab Taskflow Agent, bringing individual prompts and workflows together into structured, AI-assisted security audits.

Here are some authentication related vulnerabilities I've found:

• CVE-2023-20900 - SAML token signature bypass in VMware Tools
• CVE-2022-39366 - Missing JWT signature check in DataHub
• GHSL-2023-163 & GHSL-2023-164 - Authorization Code Exfiltration & Unrestricted OAuth2 Clients in Home Assistant
• CVE-2021-22160 - Improper Verification of Cryptographic Signature in Apache Pulsar

Excerpt of some vulnerabilities due to unsafe deserialization I've found - covering 4 different programming languages (C#, Java, Ruby & Elixir):

• CVE-2024-28213 - nGrinder vulnerable to unsafe Java objects deserialization
• CVE-2022-36038 - Remote Code Execution (RCE) in CircuitVerse
• CVE-2020-15150 - Paginator (for Elixir Ecto): Remote Code Execution Vulnerability
• CVE-2018-8540 - Microsoft .NET Framework: Remote Code Injection Vulnerability

• Publications:
  • My posts on the GitHub Blog
  • 🗨️ Mastodon: @ulldma
  • 🗨️ Bluesky: @ulldma