Vasilii Ermilov

Security researcher, bug hunter, software engineer.

linkedin twitter github email

./

publications

2025 Can LLMs Detect IDORs? Understanding the Boundaries of AI Reasoning semgrep.dev ↗ 2025 Finding vulnerabilities in modern web apps using Claude Code and OpenAI Codex semgrep.dev ↗ 2025 A Technical Deep Dive into Semgrep’s JavaScript Vulnerability Detection semgrep.dev ↗ 2020 Exploiting dynamic rendering engines to take control of web apps semgrep.dev ↗ 2020 Hardcoded secrets, unverified tokens, and other common JWT mistakes semgrep.dev ↗

./

presentations

Can LLMs Really Find IDORs? Limits of AI Security Reasoning

├── BSides Montreal Sep 2026 slides

├── BSides Vancouver Jun 2026 slides

└── BSides Calgary May 2026 slides

Finding vulnerabilities in modern web apps using LLMs

└── CyberToronto Dec 2025 slides

Most common vulnerabilities in Github Actions

├── BSides Seattle Apr 2025 slides

├── OWASP SnowFROC Mar 2025 slides

└── BSides Singapore Sep 2024 slides

Saving a SAST Program in Distress

└── OWASP Toronto Apr 2022 video

Scale Security with Secure Defaults & Eliminating Bug Classes

└── OWASP Ottawa Jul 2021 video

./

vulnerabilities

idtargetclassseverityyear

medium CVE-2026-25738 [github] indico/indico SSRF 2026 medium CVE-2025-59034 [github] indico/indico IDOR 2025 critical CVE-2020-8129 [npm] script-manager RCE 2020 critical CVE-2020-8128 [npm] jsreport SSRF (RCE) 2020 high CVE-2019-5479 [npm] larvitbase-api RCE 2019