💣 We caught
@ycombinator–backed
@gecko_secstealing two of our CVEs, one on
@ollama, one on
@Gradio. They copied our PoCs, claimed CVE IDs, and even back-dated their blog posts. Here’s the full story 👇
FuzzingLabs on X: "💣 We caught @ycombinator–backed @gecko_sec stealing two of our CVEs, one on @ollama , one on @Gradio. They copied our PoCs, claimed CVE IDs, and even back-dated their blog posts. Here’s the full story 👇"
😡 This isn’t just about two CVEs, it’s about integrity in security research. We follow responsible disclosure. They waited for our public reports, copied the PoCs, re-submitted them, and took the credit.
🚨 What we found: – All PRs were created after our legitimate Huntr reports went public. – Some stolen vulns now even have two CVE IDs (one from Huntr, one from their GitHub PR). – Their blog posts were back-dated to appear older than the real disclosures.
🕵️♂️ We have indisputable evidence that
@gecko_seccopied our Proof-of-Concepts (PoCs) verbatim, including unique fingerprints we intentionally inserted to identify our work. And it’s not just us, at least 7 vulnerabilities on their website appear to be stolen from other
💡 Backed by €1M pre-seed and trusted by major clients,
@FuzzingLabsinvests in genuine research, not content farming. Our results are verifiable, public, and transparent. Seeing
@ycombinator-backed companies steal others’ work and rewrite history is unacceptable and unethical.
✊ We demand that
@gecko_sec: – Publicly acknowledge and correct the record – Attribute the CVEs to their real discoverers – Stop claiming credit for research they didn’t perform – Make a public apology to the researchers impacted Transparency matters.
Write this as one coherent post and make it sound like a human being. Don't include emojis and shit either. Just fucking write something bro omg