John Menerick

Found cross-site scripting flaws on CNN.com and reported them.

Technical editor of this IGI Global reference (ISBN 1466645261) on the organizational, legal, and technical responsibilities of information system administration. Also technical editor for 110+ peer-reviewed papers and chapters on information systems, cybersecurity, and software engineering (2008–2026).

DEF CON 23 talk (2015), also given at ToorCon 17 and ROOTCON 9, on cryptographic weaknesses and supply-chain attacks through Git internals, and how they put development pipelines at risk.

Lecture for the ISC2 West Michigan chapter on why external scrutiny and bug bounty programs find what internal testing misses. Recurring ISC2 speaker, listed as a Top Rated Speaker.

Analyzed the Firesale botnet's web panel and found exploitable flaws in the operators' infrastructure.

Found denial-of-service and cross-site scripting flaws in the Google Glass developer program and disclosed them to the Glass team, with an upstream patch to Google's mirror-quickstart-java sample.

Analyzed the Pandora DDoS botnet's command-and-control panel and found exploitable flaws that could be used to disrupt it.

Found vulnerabilities in Security Onion's CapMe interface; the Security Onion team patched them and published an advisory.

Found a vulnerability in Apache Solr running on Jetty (SOLR-4861) and coordinated the fix with the Apache Solr project.

Found SQL injection and input validation flaws in the Scalr cloud management platform.

Analyzed how HTTP and cookie RFCs are implemented and found denial-of-service techniques that abuse them.

Contributor to the Building Security In Maturity Model (BSIMM), the software security benchmark used to measure and compare security programs.

DEF CON 22 talk (2014) on how much internet infrastructure runs on open-source software that nobody has reviewed and nobody is funded to secure. Built the dataset behind it: 2,000+ open-source projects analyzed with a Jenkins pipeline on an AWS spot fleet.

Showed how a disguised USB charging station, such as a laptop hidden in a jacket and offered as free charging at an event, can compromise smartphones.

Analyzed the BlackEnergy botnet's command-and-control infrastructure and found exploitable flaws that could be used to disrupt it.

Found vulnerabilities in Basecamp and 37signals infrastructure and disclosed them to 37signals.

Found a secret-handling flaw in Square's Keywhiz secret management system and reported it through Square's bug bounty program; Square engineers opened the fix (PR #50) from the report.

Found a denial-of-service flaw in the Apache Batik SVG toolkit (BATIK-1023) and reported it to the Apache Batik project.

Found a cross-site scripting flaw in MediaWiki core, the software behind Wikipedia (CVE-2015-6729).

Reported a cross-site scripting issue in jQuery core (ticket #12254), a library used on millions of sites.

Found cross-site scripting flaws in the LDAP Tool Box Self Service Password application.

Found unpatched cross-site scripting and a potential remote code execution path in the Cloud9 online IDE.

Reverse-engineered the Carberp banking trojan's command-and-control and found exploitable flaws and broken cryptography.

Found a sandbox breakout in Google Translate and reported it to Google.

John Menerick's Github metadata

DEF CON Black Badge (won DEF CON Hacker Jeopardy); winning Hacker Jeopardy team at ROOTCON 9; Hack The Box Elite Hacker, solo global rank #602 and team rank #41 (as of 07/2026); ranked #1134 of 60,000+ researchers on Bugcrowd, with Security Halls of Fame at Google, Oracle, VISA, eBay, Square/Block, and FanDuel.

CodersRank global rank #364 of 627,824 developers (top 1%, as of 07/2026). I compete in coding competitions to keep my programming sharp.

Selected detection and response results from the roles above: incident response automated to under 3 minutes at Lake Michigan Credit Union; 4,000+ generated playbooks run in an autonomous SOC at Plastiq; custom intrusion detection and response at NetSuite that delivered $19M+ in savings; and SentinelMesh, an autonomous incident response system deployed for Syn Agency clients that produces signed evidence chains 47 seconds after the initial alert. Also: sworn volunteer in incident management with the Alameda County Sheriff's Office of Emergency Services.

Run two public security-metrics labs: IntelMetrics, which continuously ingests global threat feeds (including MISP) into metrics and attribution insights, and VulnMetrics, which parses and prioritizes the NVD to measure the gap between disclosure and patch.

Two open-source research prototypes. zk-Autograd proves each optimizer step of PyTorch training with EZKL (Halo2) zk-SNARK proofs generated inside AWS Nitro Enclaves or OCI Confidential VMs. Mimir lets mutually distrustful parties run transformer inference together using SPDZ-style multi-party computation behind attested enclaves.

Talks and lectures since 2002, including DEF CON 22 and 23, Chaos Communication Camp, ToorCon, DerbyCon, GrrCON, ROOTCON, BSides, Stanford, JavaOne, and ISC2, where he is listed as a Top Rated Speaker.

Kubernetes SIG Security contributor and CNCF SIG Security member, with security reviews in Kubernetes' early years. Certified Kubernetes Security Specialist (CKS) and Administrator (CKA).

Participant in the DARPA AI Cyber Challenge (AIxCC), which asked teams to build AI systems that find and fix vulnerabilities in open-source software.

OWASP CFP and CFW review board; Kubernetes SIG Security and CNCF SIG Security; Cloud Security Alliance steering committee; contributor to the White House Executive Order on AI and NSTIC; co-author of the TAME/AARM agent-security governance frameworks; InfraGard; DoD satellite communications.

White House Letter of Recognition; US Senate, US House, and Michigan State Senate resolutions; commendations from four military branches; wreath bearer at the Tomb of the Unknown Soldier; DEF CON Black Badge.

Security research on video and audio: the W8MEJ YouTube channel, Complex Systems Live on Twitch, and the Zero Noise Collective podcast.

Vetted member of Project Glasswing and the Anthropic Cyber Verification Program, involved since each launched in April 2026.

148 posts since 2011, including four research series: Autonomous AI SOC (8 episodes, 2025), Morphogenetic SOC (9, 2026), Project Butterfly of Damocles (10, 2026), and Beyond Verifiable Reward (12, 2026).

Open-source toolkit (12 repositories): YubiKey PIV and FIDO2 credentials backing HashiCorp Vault SSH certificates and dynamic database credentials, FROST threshold-signed API keys with OPA, Terraform state protection, and credential rotation across AWS, OCI, GCP, and Azure.

Worked with Team Shellphish, a DARPA Cyber Grand Challenge finalist, as an unofficial contributor: sat in on team meetings and helped with the work without formally joining the team. CGC was the first all-machine hacking tournament: autonomous systems found, exploited, and patched vulnerabilities without human help.

A security roadmap for startups, organized by funding stage, drawn from being the first security hire at NetSuite, Plastiq, and SeedFi.