Web3 Security, solutions architect, bug hunter, DevSecOps.

California
Joined March 2010
🚀 The Web Almanac 2025 is live! Proud to have authored the Privacy chapter and reviewed the Security chapter for this year's edition. The Web Almanac is HTTP Archive's annual deep-dive into how the web is actually built, analyzing millions of sites with real data, peer review, and 90+ contributors. Key finding: 75% of sites have at least one tracker 👀 📖 Privacy: almanac.httparchive.org/en/2… 🛡️ Security: almanac.httparchive.org/en/2… #WebAlmanac #Privacy #Security #InfoSec
1
3
262
Today we launched Agent Matrix at Monaco. Proud of this team. A lot of late nights went into it and it shows. Go check it out 👇
1
1
27
Vinod Tiwari retweeted
Today Monaco is launching Agent Matrix. Monaco unleashes countless agents working together, goal seeking, with one outcome in mind: accelerate revenue growth. If you don’t have an army of agents working 24/7 to accelerate revenue growth, you’re living in the past. Apply for early access now.
181
131
61
2,974
1,697,453
Replying to @sama @elonmusk
15
78
4
3,672
334,688
Vinod Tiwari retweeted
Legacy SaaS is in serious trouble. By the time your product leaders are offering to pay churned customers to see a demo of the platform winning all your business, the game is already over.
68
31
18
518
322,737
Introducing Kitesurf: a browser built for agents, running entirely on Cloudflare Workers. Chromium is too heavy to hand every agent one. Kitesurf is written in Rust, uses 3-7x less CPU and memory, and spins up per request. Free in beta: blog.cloudflare.com/kitesurf…
154
599
248
6,801
1,427,447
Vinod Tiwari retweeted
Starting today, Kled runs on DATA. The world's largest opt-in human-data marketplace with over 1B records is now fully auditable. Kled’s founder, Avi Patel (@avipat_), joins us with a single mission: make all AI training data auditable by default.
Kled the leading human data marketplace has officially partnered with The DATA Foundation to onboard over 1.5 billion user records on chain. We've spent the last 3 months working directly with some of the leading foundation models and labs. The single biggest point of discussion was trust. Labs have 0 room for error and consumer data is the single largest but also most sensitive data type on the planet. Labs need two things before confidently purchasing a dataset. 1. A clean audit record: end-to-end receipts, consent forms, and proof of payment. They need to fully trust that data uploaded on the marketplace can confidently be licensed without consumers introducing risk into training pipelines. 2. Full confidence that the data on our marketplace is original. Not pirated, not AI generated. They need to fully trust that data uploaded is real human unaltered content that can significantly enhance a training pipeline. We've been hugely against 99% of all blockchain offerings that have come our way, but things aligned way too well here and we found a unique opportunity to build something great. Kled will be moving its full audit rails onto DATA Network, backed by a16z crypto, Polychain, and other top VCs. The instant a user uploads data to our platform we create an anonymized receipt that is automatically sent to the TRACE (demo video, live links, and more in the post below). The content hash ID, signed consent forms, full payment record, and end-to-end timestamps. Any AI lab can now verify the legitimacy of any dataset in seconds, making us the first data marketplace in history to publicize its data audit records. Consumer identities are fully anonymized and hidden, no users will be exposed in the process. To add to this Kled will also be supporting USDC payouts on DATA Network. This will be alongside other stablecoin options rolling out with our existing fiat payouts. All of this will be fully auditable on DATA Network as well. Lastly Kled and The DATA Foundation will be pooling its efforts to create the world’s best fraud detection protocol. We will be allocating the majority of our time/resources towards creating this, labs need to trust our data and the creation of AGI will be a function of this trust. I'm also joining The DATA Foundation with a Part Time Advisor Role as the Chief Data Officer, where I’ll be advising the foundation team to make sure the Trace audit product reflects what AI labs actually need to license data with confidence. The DATA Foundation's audit / licensing rails and Kled's data marketplace are complimentary in nature, labs need both. Kled is the largest contributor to that audit layer so we have the most skin in the game to get this product right. Every effort described here will create a safer future for consumers and labs. We are here to set the gold standard for trust and nothing will stray us away from this goal. Onward.
29
12
1
121
18,189
Vinod Tiwari retweeted
New name, more focused mission, tackling the most important problem in AI today. We started Story to move the world's IP onchain. What became crystal clear is that the most valuable IP in the world of AI is actually data. Specifically the real, human, licensable data every AI lab needs and can't get cleanly. Soon enough, every company sitting on human behavior will become a data business, whether they intend to or not. The teams that can source that data at scale and prove where it came from with consent will build some of the most valuable companies of this era. Excited to have @devrelius lead as the Chief Executive Officer with @avipat_ as the Chief Data Officer role (advisory) at The DATA Foundation. I'm excited to continue supporting The DATA Foundation team and their mission through my efforts at @piplabsxyz and @psdnai. We won’t stop until all AI training data leaves a trace. We won’t stop until all AI training data leaves a trace.
27
10
3
96
13,710
Here is my most recent project: sci-bot.ru Unlike Sci-Hub and Sci-Net, where I have written all the code manually be hand, this one is pure AI generated - I decided to do this as a kind of experiment. LOVE the result! AI is 50x speedup in code writing, however creating the project is still a lot of work (human input is still needed for architectural decisions, debugging complex functionality and precise instructions) Sci-Bot is connected to Sci-Hub database so it can read research articles and generate answers grounded in science. To pay for generated tokens, Sci-Bot supports two funding models: the first one is standard pay-as-your-go and the second one is legacy from Sci-Hub: it is donation based. Anyone can donate: from these donations, the project will automatically calculate budget for upcoming month, and derive how much AI-generated answers it can serve to users for free.
66
275
22
1,559
101,839
Vinod Tiwari retweeted
you never think this will happen to you, but this happened to me today. a DPRK actor posed as somebody i previously worked with at the arbitrum foundation to have a catchup call. they reached out via telegram, in a channel where we had an existing messaging history. the DPRK actor sent me what looked to be a legitimate teams link, but when i opened it, it said a software update was necessary, which entailed downloading and running a malicious file. in the group call, there was video of everybody on the call, including the person i had previously worked with. stay vigilant and be safe! don’t be afraid to send out your own video conferencing links if you see something suspicious.
🚨 WARNING (AGAIN) DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets. They're taking over your Telegrams -> using them to rekt all your friends. They've stolen over $300m via this method already. Read this. Stop the cycle. 🙏
32
53
11
372
114,497
Vinod Tiwari retweeted
🚨 BREAKING: Wiz Research discovered Remote Code Execution on GitHub.com with a single git push The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯
103
969
173
4,396
569,945
Vinod Tiwari retweeted
Solana traders showing up to buy ETH tokens
224
324
64
3,152
301,770
Vinod Tiwari retweeted
Sorry to say, Lazarus Group is the top hardworking smart contract security auditor in the world. Other auditors charge $50k and miss critical vulnerabilities. These guys work for free and never leave any money from the contract. Their resume: • Bybit: $1.5 Billion • Drift: $285 Million • WazirX: $235 Million • KelpDAO: $292 Million • DMM Bitcoin: $308 Million • Axie Infinity (Ronin): $625 Million And many others.
136
219
36
2,033
219,972
Vinod Tiwari retweeted
"so you staked your ETH on the Ethereum blockchain to earn yield?" "yes, Dave" "except you didn't want your capital to be locked up so you actually staked it with a liquid staking protocol called Lido?" "that's correct, Dave" "and Lido gave you a liquid staking receipt token called stETH in return?" "yes, Dave" "and then you didn't think that was enough, so you juiced the yield even further by depositing your stETH receipt tokens into a restaking protocol called Eigenlayer?" "you are correct, Dave" "and now you didn't want to lock up your capital, so you actually restaked with a liquid restaking protocol called KelpDAO who provided you with a liquid restaking receipt token called rsETH?" "you got it, Dave" "and then that was surely not enough juice, so you then deposited your rsETH tokens into a lending protocol called AAVE so that you could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero whose security is held together by a 1/1 toothpick, which was obviously hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry" "you are 100% correct, dave" jfc.
401
964
226
7,926
752,353
CVE correlation via OSV.dev. SARIF output for GitHub Code Scanning. Real-time fsnotify watchers catch extension installs within 30 seconds. Optional self-hosted portal for fleet visibility. MDM playbooks for JAMF/Mosyle/Kandji. Apache 2.0.
63
Risk model for extensions: Critical / High / Medium / Low based on activation events, capabilities, and contributes. AI configs get their own score — wildcard Bash(*), plaintext keys, autonomous exec, insecure transports all surface as Critical/High.
11
What it scans on every dev machine: • IDE extensions across 7+ IDEs (VS Code, Cursor, JetBrains family, VSCodium, Sublime, Vim, Xcode) • Packages — incl. deps bundled inside extensions (invisible to SCA) • AI tool + MCP configs (Claude Code, Cursor, OpenClaw) • Plaintext secrets in .env + git history • Tamper + --no-verify bypass
106