# OpenDoors

> OpenDoors (opendoors.wtf) is the technical blog of Vibhek Soni, a backend engineer in New York. It covers reverse engineering, security research, malware analysis, AI infrastructure security and backend engineering.

Author: Vibhek Soni, also known as vibheksoni and ImVibhek. Backend engineer in New York. I build API infrastructure and security tools, usually by taking a protocol apart first and building on what I learn.
Main topics: api security, network security, python, ai security, broken access control, devsecops, rce, reverse engineering, software engineering, web security, windows internals, ai agents.
Every post is also available as plain Markdown at the same URL with .md instead of a trailing slash.
Translations of most posts are available in Spanish (/es/blog/), Portuguese (/pt/blog/), German (/de/blog/), French (/fr/blog/) and Japanese (/ja/blog/). English is the original.

## Posts

- [Taking Apart Bun Executables With unbuned](https://opendoors.wtf/blog/unbuned-bun-executables/): How Bun packs an app into one executable and how unbuned finds the bundle, reads Bun's module graph and recovers the original TypeScript. (2026-10-18, Markdown: https://opendoors.wtf/blog/unbuned-bun-executables.md)
- [How I Built stealth-browser-mcp](https://opendoors.wtf/blog/stealth-browser-mcp/): Why I built stealth-browser-mcp, how it gives AI agents a real Chrome over MCP and CDP and the benchmark that keeps me honest about what it can do. (2026-10-18, Markdown: https://opendoors.wtf/blog/stealth-browser-mcp.md)
- [Ferrox: Dissecting a Modern Rust-Based Infostealer](https://opendoors.wtf/blog/ferrox-stealer-research/): A deep technical analysis of Ferrox, a Rust Windows stealer with Hell's Gate syscalls, polymorphic builds and a Chrome App-Bound bypass. (2026-02-26, Markdown: https://opendoors.wtf/blog/ferrox-stealer-research.md)
- [Building the First Open-Source DMA HWID Spoofer](https://opendoors.wtf/blog/dma-hwid-spoofer/): How I reversed Windows 11 kernel drivers in IDA Pro to build a DMA hardware ID spoofer in Rust, covering PatchGuard, DSE and SMBIOS. (2026-02-24, Markdown: https://opendoors.wtf/blog/dma-hwid-spoofer.md)
- [Zero Auth, Full Control: The Risks of Open Claude Code Web UIs](https://opendoors.wtf/blog/claude-code-webui-security/): A security analysis of open-source web UIs for Claude Code, with unauthenticated RCE, path traversal and client-side auth bypasses. (2026-01-23, Markdown: https://opendoors.wtf/blog/claude-code-webui-security.md)
- [EvilChrome: Chrome Security Research PoC](https://opendoors.wtf/blog/evilchrome-research/): A proof of concept showing how a replaced Chrome binary can be turned against its user and why binary replacement attacks matter. (2026-01-23, Markdown: https://opendoors.wtf/blog/evilchrome-research.md)
- [The Hidden Risks of Exposed LM Studio Servers](https://opendoors.wtf/blog/lmstudio-api-security/): How the local server feature in LM Studio can put your AI models on the internet and what to do about it. (2026-01-23, Markdown: https://opendoors.wtf/blog/lmstudio-api-security.md)
- [Exposing the Risks of Open Ollama APIs](https://opendoors.wtf/blog/ollama-api-security/): How the Ollama API service can end up reachable from the internet and the practical steps that close it off. (2026-01-23, Markdown: https://opendoors.wtf/blog/ollama-api-security.md)
- [OpenCode Web: Great Tool, Dangerous Default](https://opendoors.wtf/blog/opencode-web-security/): OpenCode is a multi-model alternative to Claude Code and its web interface can be a serious problem if you leave the defaults alone. (2026-01-23, Markdown: https://opendoors.wtf/blog/opencode-web-security.md)
- [The Dangerous Illusion of the 'Solo AI Developer'](https://opendoors.wtf/blog/security-risks-of-fully-ai-written-apps/): Why handing a whole project to an AI agent leads to vulnerable software and how to work with one as a co-developer. (2026-01-23, Markdown: https://opendoors.wtf/blog/security-risks-of-fully-ai-written-apps.md)

## Author

- [Portfolio](https://vibheksoni.com/): Vibhek Soni's portfolio and work
- [GitHub](https://github.com/vibheksoni): source code for the tools written about here
- [X](https://x.com/ImVibhek)
- [LinkedIn](https://www.linkedin.com/in/vibheksoni/)
- Contact: vibheksoni@engineer.com

## Projects

- [stealth-browser-mcp](https://github.com/vibheksoni/stealth-browser-mcp): MCP server that lets AI agents drive a real Chrome browser
- [unbuned](https://github.com/vibheksoni/unbuned): Pulls the JavaScript back out of Bun executables
- [UniSessions](https://github.com/vibheksoni/session-export): Converts sessions between AI coding agents
- [FreeTheAI](https://freetheai.org/): Free AI API and open model marketplace
- [secrets.wtf](https://secrets.wtf/): Index of exposed AI infrastructure

## Optional

- [Full text of every post](https://opendoors.wtf/llms-full.txt)
- [RSS feed](https://opendoors.wtf/rss.xml)
- [Sitemap](https://opendoors.wtf/sitemap-index.xml)