$ cat faq.md
Frequently asked questions
Short answers about KuniNogu, research, coordinated disclosure, and ways to get in touch.
Who is KuniNogu?
KuniNogu is the public name used by Kuniyoshi Noguchi (野口 晋義), a cybersecurity engineer working across AI security, vulnerability research, security operations, incident response, threat hunting, and detection engineering.
What public vulnerability credits does KuniNogu have?
The public record currently links Kuniyoshi Noguchi (KuniNogu) to six CVEs covering the Splunk MCP Server app, Apache Struts, @fastify/http-proxy, Drupal AI Agents, Drupal AI, and the Drupal OpenAI Provider. Redmine also lists an official non-CVE security credit for issue #44174. The Advisories page links each claim to a vendor, maintainer, CVE, or JVN primary record.
What does KuniNogu research in AI security?
The focus is the trust boundary where AI agents and applications connect to permissions, data, MCP servers, plugins, external tools, callbacks, webhooks, and asynchronous tasks. The research examines whether the acting principal and delegated scope remain enforced when a model-mediated request becomes a privileged application action.
How are vulnerability research and detection engineering connected?
A vulnerability's root cause is used to identify observable behavior, required telemetry, hunting hypotheses, false positives, limitations, and incident-response actions. Public detection examples distinguish tested logic from illustrative or pseudocode material, so defenders can see what still requires adaptation and validation in their own environment.
What work and inquiries does KuniNogu handle?
Relevant areas include AI application and MCP security, trust-boundary and authorization review, vulnerability research and coordinated disclosure, incident investigation, threat hunting, detection engineering, and technical writing or speaking. Specific scope and availability can be discussed through the Contact page.
How are vulnerabilities reported and disclosed?
KuniNogu follows coordinated vulnerability disclosure: report privately to the vendor or maintainer, provide a minimal and safe reproducer, allow reasonable time for remediation, review the fix, and publish a defender-focused analysis only after coordination permits it.
Are details of unfixed vulnerabilities published?
No working exploit chain, actionable attack steps, or embargoed details are published for an unfixed vulnerability. Customer, employer, and client data are also excluded; public research uses a controlled lab and public artifacts.
How can I get in touch about speaking, writing, or recruitment?
Use the Contact page for research collaboration, speaking, writing, or recruitment inquiries. For sensitive vulnerability information, follow the coordinated-disclosure guidance and security.txt linked there.
Are Japanese and English both supported?
Yes. This site provides dedicated Japanese and English pages, and inquiries can be sent in either language.