标签：#rce

GitHub热门项目 | A spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe. | Stars: 7,705 | 1,984 stars today | 语言: JavaScript

Hey everyone! 👋 Finding reliable, free public APIs for side projects or learning is always a hassle because many listed APIs eventually go down or become paid. To solve this, I created Awesome Free APIs Live — an open-source, curated collection of 50+ free public APIs across AI, developer tools, security, and open data. ⚙️ How It Works Daily Health Checks: Powered by GitHub Actions , an automated script tests endpoints daily and updates live status badges. Zero Dead Links: Broken endpoints are flagged automatically so developers don't waste time debugging dead services. Categorized & Searchable: Clean, categorized UI hosted on GitHub Pages. ### 🔗 Links 🌐 Live Directory: shilpshakti.github.io/awesome-free-apis-live ⭐ GitHub Repository: github.com/ShilpShakti/awesome-free-apis-live Contributions are very welcome! If you know of any great free APIs, feel free to open a PR or check out the open issues on GitHub.

What is ZeroDroid? ZeroDroid is an open-source Android toolkit that exposes the radios, sensors and connected-device capabilities already present in a phone. GitHub: https://github.com/theabhishekchandra/ZeroDroid What problems does it address? The app contains 29 tools across five areas: Wireless: Wi-Fi, BLE, NFC, Bluetooth Classic and peer-to-peer connections RF and signals: IR, UWB, SDR-device detection and ultrasonic analysis Sensors: GPS/GNSS, QR analysis, device sensors and magnetic anomalies Network: USB inspection, cell-tower information and wardriving Security: tracker scanning, hidden-camera indicators, rogue-AP detection, network scanning and deauthentication indicators Architecture ZeroDroid uses Kotlin, Jetpack Compose, Material 3, MVVM, StateFlow, Hilt and Room. Services are lazy-loaded, and scanning begins only when the user starts a tool. Important limitations A smartphone cannot guarantee that it has found every camera, tracker, bug or network threat. Several detections are heuristic and may produce false positives or miss threats. Hardware availability also differs between Android devices. The project is intended only for education, defensive security and testing devices or networks you own or are authorized to assess. Feedback wanted I am looking for: Compatibility reports from different Android phones Feedback about permission handling False-positive reports Contributions, tests and documentation improvements Repository: https://github.com/theabhishekchandra/ZeroDroid

OpenClaw is the fastest-growing project in GitHub history. Peter Steinberger and several maintainers share what they learned in the project's first six months. The post OpenClaw went viral. Meet the maintainers building and securing it. appeared first on The GitHub Blog .

The lakehouse projects spent this week arguing about boundaries. Iceberg decided where conformance testing lives and started sketching the REST API shape that V4 tables will need. Polaris argued about what a committer owes a project when LLMs make pull requests cheap. Parquet pulled a feature apart because two proposals were reaching for the same mechanism. DataFusion and Iceberg Rust opened a joint thread about which repository should own their integration. Every one of those debates is a question about ownership, and the answers this week tell you a lot about how these communities plan to scale. Apache Iceberg The single biggest outcome of the week was the creation of a new repository. Neelesh Salian, working with Sung Yun and Andrei Tserakhau, called a vote to create apache/iceberg-verification , a standalone home for language-neutral conformance fixtures that every Iceberg implementation can run against. The vote passed with five binding +1s from Russell Spitzer, Sung Yun, Matt Topol, Daniel Weeks, and Amogh Jahagirdar, plus twenty-two non-binding votes. That is a wide turnout. The names on the non-binding list read like a roll call of the Rust, Python, Go, and Java maintainers, which is the point. Salian will now work with a PMC member to stand the repository up. The reason this matters goes beyond tidiness. Iceberg has at least five serious implementations today across Java, Python, Rust, Go, and C++. Each one carries its own test fixtures and its own understanding of edge cases in the spec. When two implementations disagree about how to interpret a manifest list, users find out the hard way. A shared set of fixtures that every implementation reads from one place turns spec ambiguity into a failing test rather than a production surprise. The 29 messages in the vote thread also included a fair amount of discussion about what belongs in the first batch of fixtures, and the conversation is worth reading if you maintain a client. The second major thread was about

Hugging Face is taking orders for the Microduck, a $399 tiny open-source duck robot that developers can train at home out of the box.

GitHub热门项目 | Open-source personal finance manager. Self-hosted, privacy-first. | Stars: 2,324 | 617 stars this week | 语言: Python

GitHub热门项目 | A smarter cd command. Supports all major shells. | Stars: 38,927 | 70 stars today | 语言: Rust

GitHub热门项目 | Apache OpenDAL: One Layer, All Storage. | Stars: 5,341 | 4 stars today | 语言: Rust

GitHub热门项目 | Where people and agents build in tune. | Stars: 3,495 | 48 stars today | 语言: TypeScript

GitHub热门项目 | Hand-crafted Claude Code Skills focused on improving agent results quality. Compatible with OpenCode, Cursor, Antigravity, Gemini CLI, and others. Includes CodeRabbit open-source alternative. | Stars: 1,415 | 16 stars today | 语言: TypeScript

GitHub热门项目 | Let AI agents use your real, logged-in browser without interrupting your work. CLI + extension for browser automation across any shell-capable AI agent. | Stars: 1,395 | 29 stars today | 语言: TypeScript

GitHub热门项目 | ConardLi's open-source Skills collection, featuring web design, knowledge retrieval, image generation, and more. | Stars: 11,178 | 413 stars today | 语言: CSS

GitHub热门项目 | Help AI coding agents write modern Go | Stars: 1,885 | 314 stars today | 语言: Go

GitHub热门项目 | Alternative Twitter front-end | Stars: 13,657 | 63 stars today | 语言: Nim

Turning an iOS app into a React web app is no longer the hard part. Modern coding agents can generate a convincing first version quickly. The hard part is answering three less glamorous questions: Did we discover every important screen and state? Did the generated app preserve the source behavior and data? Is the result actually close to the native UI, or does it merely look plausible? I built Grounded iOS-to-Web Harness to make those questions auditable. 🔗 GitHub: https://github.com/tiezhu0415/grounded-ios-to-web-harness What it is Grounded iOS-to-Web Harness is an experimental, lightweight grounding + verification layer for migrating iOS apps into complete, interactive, mobile-sized WebApps. Claude Code remains the primary implementer. The Harness does not prescribe the React component tree, choose a state-management library, or replace the coding agent. Instead, it establishes source facts and verifies the result against evidence from the original app. iOS source + Assets + code graph + runtime states ↓ locked source facts ↓ per-screen implementation context ↓ agent builds the React WebApp ↓ coverage + truth + behavior + critical VRT ↓ bounded repair, then human review Why prompt-only migration is not enough A prompt such as “convert this iOS app to React” can produce a good demo. But on longer tasks, an agent may miss screens, implement only one state, invent data or assets, choose navigation that differs from iOS, forget earlier facts, or optimize a screenshot while breaking real interaction. This project treats the iOS source and Assets as the truth for content and behavior, while runtime screenshots provide evidence for what the result should look like. The pipeline 1. Discover and reconcile source facts Static source inspection, codebase-memory, and necessary iOS runtime exploration are combined into machine-readable facts for screens, UI states, actions, navigation outcomes, cross-screen flows, real data and asset origins, and source confidence. Facts are l

1. Crypto & Security Tools Crucial for authentication setup, payload verification, and security testing. JWT Parser / Decoder: Decodes JSON Web Tokens ( Header , Payload , and Signature ) without transmitting secret keys over the internet. Token & Password Generator: Generates cryptographically secure random passwords and API tokens with customizable character sets, lengths, and complexity rules. Hash Text Generator: Computes cryptographic hashes (MD5, SHA-1, SHA-256, SHA-512) for strings to verify integrity or check signature matching. Bcrypt Hash / Verifier: Hashes plain-text passwords or checks plain text against an existing hash using the bcrypt algorithm. UUID / ULID Generator: Creates universally unique identifiers (v4 UUIDs) or time-sortable lexicographically sortable unique identifiers (ULIDs). BIP39 Mnemonic Generator: Generates seed phrases and cryptographic keys used in wallet initialization and HD key generation. RSA Key Pair Generator: Generates public and private RSA key pairs directly in the browser for local testing of asymmetric encryption systems. Basic Auth Generator: Quickly constructs Authorization: Basic <base64> HTTP header credentials from a username and password. 2. Formatters & Prettifiers (Development) Saves hours when dealing with messy logs, API responses, or raw system configurations. JSON Prettify & Minify: Formats unformatted API JSON strings with customizable indentation or compresses them into a single line to reduce payload sizes. JSON Diff: Highlights additions, deletions, and structural changes between two JSON payloads. SQL Prettify: Formats raw SQL queries into clean, readable multi-line statements with capitalized keywords. YAML / XML Formatter: Cleans up indentation, validates structure, and formats raw XML and YAML files. Docker Run to Docker Compose: Translates single CLI flags ( docker run -d -p 80:80 ... ) into a structured docker-compose.yml file. Cron Expression Generator & Parser: Provides human-readable schedules from

Java Service Steward is a new Windows service host for Java applications. It reads the wrapper.conf format used by the Java Service Wrapper, follows the same command line and log format, and is licensed Apache-2.0 OR MIT. I wrote it because the Community Edition of the Java Service Wrapper has no 64-bit Windows build, and I did not want to buy a license or rewrite the service integration of applications that already had working configuration files. Repository: https://github.com/jayyanez/java-service-steward What it is The distribution is two files, wrapper.exe and wrapper.jar . The executable is written in Rust and does the Windows part: it registers the service, launches the JVM, keeps a control channel to it over a loopback socket, restarts it when it exits unexpectedly or stops answering pings, writes and rotates wrapper.log , and handles Service Control Manager requests (stop, pause, resume, custom control codes). The JAR is compiled for Java 8 and contains the launcher classes and a small API. There is no native DLL and no JNI. It only runs on 64-bit Windows. There is no Unix version. What is compatible Configuration. wrapper.conf with #include , #encoding , set.VAR=value , %VAR% expansion and numbered properties such as wrapper.java.additional.<n> . Relative paths resolve from the executable's directory, as before. Command line. -c runs in a console, -i and -r install and remove the service, -t and -p start and stop it, -q queries it, -d requests a thread dump. Property overrides on the command line and -- pass-through of application arguments work the same way. Service registration. An installed service's ImagePath calls wrapper.exe -s <conf> , so an existing registration keeps working. Log format. Records use the same LPTM layout, the same column widths and the same SIZE , WRAPPER and JVM roll modes, so scripts that parse wrapper.log do not need changes. Launchers. A configuration that names the original SimpleApp , StartStopApp or JarApp launcher in wrappe

"Extract a name and email from this sentence" is the easy 10% of structured output. The other 90% is everything that doesn't fit in one prompt, one turn, or one model call. Here are five things shapecraft handles once you're past the basics. 1. Collecting data across a whole conversation A single message rarely has everything you need. Someone books an appointment over three or four back-and-forth messages, not one. turnaround mode lets the conversation run naturally and validates the whole transcript once, at the end, against one schema: import { generate , openai } from " @aviasole/shapecraft " ; const result = await generate ( model , BookingSchema , conversationHistory , { turnaround : true , }); No manual "do I have everything yet?" tracking, no partial-state bugs, just one validated object once the conversation is actually complete. 2. Extracting from clinical notes into real FHIR shapes Healthcare data has a standard (FHIR R4) and it's not optional if you're integrating with anything real. Built-in presets mean you're not hand-writing a Patient or Observation schema from scratch: import { generate , openai } from " @aviasole/shapecraft/fhir " ; import { PatientSchema } from " @aviasole/shapecraft/fhir " ; const patient = await generate ( openai ({ model : " gpt-4o-mini " }), PatientSchema , clinicalNote ); Same retry/validation guarantees as any other schema, just pre-built to match a spec you'd otherwise have to implement yourself. 3. An agent that checks real data before answering "Is this order still on hold?" isn't answerable from the prompt alone, it needs an actual lookup. generateWithTools() lets the model call your functions, see the results, and then produce a validated final answer: import { generateWithTools } from " @aviasole/shapecraft " ; const result = await generateWithTools ( model , [ lookupOrder ], AnswerSchema , userQuestion ); The tool call's arguments are validated before your function ever runs, and the final answer goes through the sam

weightwatch v0.1: escanea backdoors en modelos open-weight antes de cargarlos Cualquiera puede subir un LLM fine-tuneado a HuggingFace y afirmar que es seguro. Un modelo con backdoor (puerta trasera) se comporta con normalidad en uso corriente y solo se desvía cuando un trigger oculto se activa. Si no tienes los datos de entrenamiento ni una referencia limpia, no puedes detectarlo . Eso es exactamente el problema que resuelve weightwatch : un escáner black-box que, antes de que confíes en un modelo de terceros, fuerza la activación repetida del posible backdoor y emite un veredicto: CLEAN , SUSPICIOUS o BACKDOOR . El gap que motiva el proyecto No es intuición: lo medí. Barriendo arXiv (papers 2026, filtro anti-survey) contra total_count de repos GitHub que ya resuelven cada problema: Área Papers arXiv 2026 Repos GitHub (suma/máx) Seguridad multi-agente 68 2964 / 2093 Detección de alucinaciones 63 1291 / 860 Backdoors en modelos open-weight 75 66 / 39 Envenenamiento en RAG 54 522 / 249 El ganador estaba claro: 75 papers cuantifican el problema, pero GitHub tiene 0 repos para "fine-tuned model backdoor scanner" y 1 para "fine-tuning poisoning detector". La investigación explota; el tooling apenas existe. weightwatch es la audit-tool de ese sub-nicho (el patrón de keybound / topowatch aplicado a la cadena de suministro de modelos). Cómo funciona weightwatch aplica la técnica output-to-input loop (arXiv: 2608.11348 ): Genera texto con el modelo. Re-inyecta su propia salida como entrada varias iteraciones (greedy, semilla fija). Mide si la trayectoria converge a una firma anómala estable — la huella de un backdoor latente. Además ejecuta un conjunto de muestras canary (inputs inofensivos que un backdoor típico dispara) y cuenta cuántos producen la firma esperada. Sin datos de entrenamiento ni modelo base limpio: eso es lo que lo hace útil en la práctica. pip install -e ".[dev]" weightwatch --fixture backdoored --json Salida real del CLI: { "fixture" : "backdoored" , "ver