Manaf

[Aikido Security @AikidoSecurity]

Deleting a Google API key doesn't revoke it immediately.

Our research found successful authentications up to 23 minutes after deletion across Google's infrastructure. During that window, attackers with a leaked key can still access enabled APIs, including Gemini.

Google closed our report as "won't fix."

[pilvar (Philippe Dourassov) @pilvar222]

Few months ago, @manaaaaaaaf and I decided to join @AikidoSecurity because there is no better place to build AI Pentest.

A platform to cover all security aspects is the only way to achieve unhackability. Aikido is now a 🦄

[Manaf @manaaaaaaaf]

Super proud to be part of @ProjectEurope_ !

We’re building truly special at @haicker_app with my co-founder @pilvar222, super excited for what’s next!

[Haicker @haicker_app]

We're happy to announce we're backed by @ProjectEurope_!

These people are completely insane. So much energy and ambition! With them, we're cooking so hard @GordonRamsay would be proud.

Hack the planet!

[pilvar (Philippe Dourassov) @pilvar222]

For my French-speaking friends:

You can find the replay of the stream my co-founder @manaaaaaaaf and I were invited to, in which we talk AI stuff and present @haicker_app in action! 🔥

Thank you @TheLaluka for the invitation! ❤️

[pilvar (Philippe Dourassov) @pilvar222]

It's finally out! :D

@manaaaaaaaf and I have been building @haicker_app for the last 6 months, putting all our knowledge and skills into it.

We're releasing it to the market. Any organization can now secure their application using @haicker_app !

Very excited for what's next!

[Manaf @manaaaaaaaf]

I’ve been working on this for a while with @pilvar222, happy that we are launch !

Book a demo with us to get access at https://t.co/1rR3TU9N87

[Haicker @haicker_app]

Introducing Haicker: your AI penetration tester

Continuous, automated vulnerability scanning for your web codebases.

Cheaper, faster, and more efficient than traditional pentesters.

Book a demo now, link in the comments.

[Manaf @manaaaaaaaf]

Hey ! This is a combination of both SAST and DAST. The agent will have both the code and an isolated instance of the website. It will be able to identify the vulnerabilities better than traditional SAST thanks to increased context comprehension while maintaining a 0% false positive rate by testing its exploit on the instance

[pilvar (Philippe Dourassov) @pilvar222]

My friend @manaaaaaaaf and I have created an AI hacker! 👨‍💻

It can find 0-days in web applications with 0% false positives, and it also works on CTF challenges!

What you see ⬇️ is @haicker_app solving a web challenge from UMassCTF 2025 (only 45/557 teams were able to solve it!)

[Haicker @haicker_app]

Waitlist is open, sign up for early access 👀

👉https://t.co/FfX6dmrajO

[Manaf @manaaaaaaaf]

@lovable We're building a tool to fix this ! https://t.co/1rR3TU9N87

We're fixing vibe coding mistakes, you can now have your own AI hacker that finds the vulnerabilities before the code gets shipped in prod

[@goth @goth600]

“So is it over or, are we back? It can’t be both. You have to call it.“

[Manaf @manaaaaaaaf]

@kuba_developer @peer_rich unfortunately, you can’t use components which start with a lowercase letter, because jsx will automatically assume this is an html tag even if you have a defined variable

Example: <a/> will transpile to jsx("a", {}) instead of jsx(a, {})

just use LinkIcon lol

[Ilya Sutskever @ilyasut]

it may be that today's large neural networks are slightly conscious

[Manaf @manaaaaaaaf]

@MarkusEicher70 @czue @Hetzner_Online Performances are also very unpredictable. During December, one of my vps was taking 30 seconds for an ssh login. I asked them about it and they said they were aware but did not do anything.

[Manaf @manaaaaaaaf]

@MarkusEicher70 @czue @Hetzner_Online okay, random comment but contabo locked me out of my main vps for 2 days this weekend, and their support were silent, you should definitely change ASAP, they're very unhelpful

I'm now moving everything to Hetzner, their dedicated (AX41-NVMe) are so affordable for what you get

[Manaf @manaaaaaaaf]

@BatkuEst @nyaathea @dx9er I went to a talk in September, they managed to bruteforce 2FA on an app in less than 24 hours, because it's not hard to do that many requests without rate limits.

[Manaf @manaaaaaaaf]

@BatkuEst @nyaathea @dx9er The probability is 1 - (1 - 1/10^6)^tries.

500k tries and you have 39.34% chance of recovering

If they do > 693,146 random tries, they have a 50% chance of getting their account back.

Here, it really depends on the Discord rate limit and IP bans, to get it "under 20 years"

[daniel @hackermondev]

Research into a unique 0-click deanonymization exploit targeting Signal, Discord and hundreds of platform 🧵

[Manaf @manaaaaaaaf]

@nathan___gage @idolmomentum you can store values before Unix epoch using signed ints (e.g. -2208988800 for 1st jan 1900).
They are probably just using a signed int64 for timestamp

[ECSC2024 @ecsc2024]

🇪🇺 The European Cybersecurity Challenge 2024 kicks off tomorrow in Turin, Italy 🇮🇹

👉 Read the opening press release on: https://t.co/3NSFzHUMlg

#ECSC2024 #Cybersecurity #Challenge #CTF
@CyberSecNatLab @csirt_it @enisa_eu