HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
google
security-research
C2020–2026
google / security-research

security-research

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

Security & Privacy
Explore on GitHubRead Hacker News discussions
28Distinct people
31Mentions
0Explicit recommenders
4.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 11:34:28 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year31 dated mentions

Observed mentions: 2020-08-10 22:33:00 UTC to 2026-08-14 02:29:26 UTC.

02462020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 5 mentions; 5 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 6 mentions; 3 submissions, 3 comments20232024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 6 mentions; 3 submissions, 3 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC422
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC303
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC550
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC633
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC211
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC633
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC505

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
Security Research This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code. We believe that vulnerability disclosure is a two-way street. Vendors, as well as researchers, must act responsibly. This is why Google adheres to a 90-day disclosure deadline. We notify vendors of vulnerabilities immediately, with details shared in public with the defensive community after 90 days, or sooner if the vendor releases a fix. You can read up on our full policy at: https://www.google.com/about/appsecurity/. Advisories The disclosure of vulnerabilities are all in the form of security advisories, which can be browsed in the Security Advisories page. License & Patents The advisories and patches posted here are free and open source. See LICENSE for further details. Contributing The easiest way to contribute to our security research projects is to correct the patches when you see mistakes. Please read up our Contribution policy.
Read the full README on GitHub

What Hacker News says

6 sources
nh2·Oct 14, 2023
> It's rock-solid. Unfortunately, I cannot confirm. Sharing my experience: I used tinc over multiple years on production servers and it would sometimes create netsplits that did not recover. I also suspect that there's a race or bug in re-keying, which also causes disconnects. On the netsplit issue, it was me posting alone on the relevant issue [1] over multiple years without response. (I don't expect to get any from free-time maintainers, especially on hard-to-reproduce issues, but it's still important to know that such unsolvable hurdles exist.) When I switched to Nebula, it improved this situation. But both Nebula and tinc max out at around 1 Gbit/s on my Hetzner servers, thus not using most of my 10 Gbit/s connectivity. This is because they cap out at 100% of 1 CPU. The Nebula issue about that was closed due to "inactivity" [2]. I als
Read the rest
o observed that when Nebula operates at 100% CPU usage, you get lots of package loss. This causes software that expects reasonable timings on ~0.2ms links to fail (e.g. consensus software like Consul, or Ceph). This in turn led to flakiness / intermittent outages. I had to resolve to move the big data pushing softwares like Ceph outside of the VPN to get 10 Gbit/s speed for those, and to avoid downtimes due to the packet loss. Such software like Ceph has its own encryption, but I don't trust it, and that mistrust was recently proven right again [3]. So I'm currently looking to move the Ceph into WireGuard. Summary: For small-data use, tinc and Nebula are fine, but if you start to push real data, they break. [1]: https://github.com/gsliepen/tinc/issues/218 [2]: https://github.com/slackhq/nebula/issues/637 [3]: https://github.com/google/security-research/security/advisor...
In Would we still create Nebula today?
e1g·Jun 3, 2023
Big fails from small things are common. A few recent examples off the top of my head - 1. Bing.com had an issue whereby attackers could inject XSS code to all visitors, due to a simple misconfiguration in Azure. 2. Visual Studio Code had a Remote Code Execution vulnerability triggered by a simple link. 3. LastPass had all of its secrets and backups taken via a compromised developer's machine. 4. CircleCI was breached and leaked everyone's OAuth tokens and secrets by malware. 5. Heroku and Okta were breached due to a compromised token, had their source code taken, and potentially leaked customer secrets. [1] https://www.wiz.io/blog/azure-active-directory-bing-misconfi... [2] https://github.com/google/security-research/security/advisor... [3] https://blog.lastpass.com/2023/03/security-incident-update-r... [4] https://circleci.co
Read the rest
m/blog/january-4-2023-security-alert/ [5] https://status.heroku.com/incidents/2413 https://www.bleepingcomputer.com/news/security/oktas-source-...
In Ask HN: Real-life, ridiculous security incidents?

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.