Haitao Zheng (Tao)

Blue team and cloud security, systems and infrastructure engineering

Cyber Security & Privacy student at H-BRS in Bonn, Germany. I build small, explainable security tools and send fixes upstream to the projects I use, among them Trivy, Prowler, pyinfra and ansible-lint. Red Hat Product Security credited me with discovering CVE-2026-120829 in Ansible.

merged PRs
34
repositories
7
combined stars
70.5k
articles
30
Haitao Zheng

Security tooling, cloud logs, IOC workflows, and static-first web systems.

focus
blue-team / cloud-security / systems
stack
Python / Java / C / SQL / TypeScript
web
Astro / CSS / Markdown / GitHub / Cloudflare
tao@tzheng.dev: ~
$ whoami
haitao.zheng / tao

$ focus --area
cloud-security / blue-team / systems

$ builds --selected
01  cloudtrail-quickscan
02  jsonl-lens
03  socket-state-triage
04  sentinel-ioc-toolkit
05  heartbleed-lab

$ upstream --merged
34 PRs / 7 projects / 2026-11-03

$ disclosures
CVE-2026-120829 / Ansible

Open source

Fixes I needed in tools I use, sent upstream and merged after review.

All merged PRs

CVE-2026-120829

Ansible

Reported to Red Hat Product Security, which assigned the CVE and credited me with the discovery.

Upstream fix in progress. Technical details will follow the public advisory.

Merged per month Jul–Nov 2026

7 Jul
7 Aug
11 Sep
9 Oct
0 Novto date
Snapshot verified Nov 3, 2026: merged pull requests by 0xTaoZ outside personal repositories; stars as of the same date.

A year on GitHubNov 2, 2025 – Nov 3, 2026

529 public contributions 109 active days busiest Oct 2, 2026 (35)

Public contribution calendar from github.com/0xTaoZ. Drag to turn it. Hover a bar for the day.
  1. cfn-lint

    Amazon Web Services (AWS), 11 merged

    Validate CloudFormation lifecycle policies.

    Problem
    A bare Fn::Select used as a CreationPolicy or UpdatePolicy passed linting, but CloudFormation rejected it unless AWS::LanguageExtensions resolved it first.
    Change
    Check CreationPolicy and UpdatePolicy at the policy layer. Keep the shared Fn::Select resolver unchanged.
    Why
    The rule belongs to the policy attribute; other uses of the function need to keep working.

    Merged September 2026 · policy and intrinsic-function tests

    Merged patch #4704
  2. pyinfra

    Infrastructure / SSH, 16 merged

    Support OpenSSH host certificates.

    Problem
    OpenSSH certificate-authority entries were skipped while loading known_hosts. A server signed by a trusted CA then appeared to be an unknown host under strict checking.
    Change
    Keep CA entries separately, then check the host pattern, certificate principal and validity period. Strict checking stays enabled.
    Why
    Supporting the certificate format still requires checking whether that certificate is trusted.

    Merged September 2026 · connector regression tests

    Merged patch #1945
  3. Prowler

    Kubernetes / Security checks, 3 merged

    Report Pods using hostPath volumes.

    Problem
    Pods can mount node filesystem paths with hostPath volumes. A useful check needs volume evidence from the Kubernetes service model.
    Change
    Collect Pod volume data and report one finding per Pod. Tests cover the collected data and the check.
    Why
    The check can only evaluate volumes that the collector has kept in the Pod model.

    Merged July 2026 · service collection and check tests

    Merged patch #11837

Projects

Command-line tools for log and host review, and a Heartbleed lab from a course project.

cloudtrail-quickscan

Cloud investigation

An explainable first pass over AWS audit logs: IAM changes, logging disruption, public exposure and unusual activity.

  • Python
  • AWS CloudTrail
  • CLI
  • Unit tests
Input
Local CloudTrail JSON; no AWS credentials.
Checks
IAM changes, logging disruption and public exposure.
Output
Severity, event context and text or JSON reports.
Evidence
Synthetic fixtures, unit tests and investigation notes.

jsonl-lens

Data inspection

A quick inspection tool for messy event exports: missing fields, type changes, nested paths and noisy identifiers.

Schema
Missing values, nulls, scalar types and nested paths.
Signal
High-cardinality warnings remain visible when value lists are hidden.
  • Python
  • JSON Lines
  • CLI
Read the case study

socket-state-triage

Linux socket review

A dependency-free utility for reviewing Linux socket state, wildcard listeners and broad privileged-port bindings.

Parser
C implementation with explicit wildcard-address handling.
Review
Broad listeners and privileged ports, checked with make test.
  • C
  • Linux
  • No dependencies
Read the case study

Sentinel-IOC-Toolkit

Indicator extraction

Extracts and normalizes indicators from investigation text, including defanged URLs, domains, hashes and CVE identifiers.

Extraction
Defanged URLs, IPs, domains, hashes, email and CVE IDs.
Enrichment
Optional reputation lookup; --no-enrich keeps parsing offline.
  • Python
  • IOC
  • JSON
Read the case study

Heartbleed lab

Vulnerability reproduction

A repeatable lab that reproduces CVE-2014-0160 against a vulnerable and a patched OpenSSL side by side, for a course project at H-BRS.

Setup
OpenSSL 1.0.1f target and 1.0.1g control, both built from source.
Isolation
Three containers on an internal Docker network with no route out.
Course
Group project for an application security course at H-BRS.
  • Docker
  • OpenSSL
  • Python
  • GitHub Actions
Read the case study

Education

  1. Hochschule Bonn-Rhein-Sieg (H-BRS)

    University of Applied Sciences, Germany

    B.Sc. Cyber Security & Privacy

    Details
    Academic focus
    Java programming, Linux, networking protocols, SQL database systems, mathematics and Technische Informatik (digital and analog electronics).
    Privacy & security
    The General Data Protection Regulation (GDPR), privacy by design and infrastructure security under European regulation.
    Coursework & projects
    Systems programming assignments and projects in Java, C, SQL, networking and Linux.
  2. FHM University of Applied Sciences

    Bielefeld, Germany

    University Preparation & FSP

    Details
    University preparation
    Completed the German university preparatory pathway and Feststellungsprüfung (FSP).
    Language achievement
    Certified German C1 within the same six months.
  3. Harvard CS50x

    Online course

    Computer Science Foundations

    Details
    Engineering foundations
    Completed CS50x coursework in algorithms, data structures, C, Python, SQL and web development.
    Final project
    Completed an independent final programming project.
  4. Xiamen Jimei Middle School

    Xiamen, China

    High School Diploma

    Details
    Academic background
    Completed science-focused secondary education in Xiamen.
    Academic transition
    Completed the Gaokao before continuing university preparation in Germany.

Toolkit

Tools and languages used in the work above.

Area Used for See

Systems & infrastructure

  • Linux
  • SSH
  • Networking

Linux, networking coursework and SSH connector fixes in pyinfra.

Cloud & security

  • AWS CloudTrail
  • CloudFormation
  • Kubernetes
  • ECS

AWS audit-log review, CloudFormation validation and Kubernetes security checks through local tools and upstream contributions.

Software supply chain

  • Trivy
  • GuardDog
  • Licenses

License detection in Trivy's JAR parser and safer finding links in GuardDog's package scanner.

Development

  • Python
  • Java
  • C
  • TypeScript
  • SQL

Python parsers, Java access-log review, C socket inspection and TypeScript application rules.

Deployment

  • GitHub Actions
  • GitHub Pages
  • Cloudflare Workers
  • D1

GitHub Actions and GitHub Pages for this site; Worker APIs and SQL persistence in StudyPulse.

Technical writing

  • Markdown
  • Code review

Notes on specific fixes, test cases and implementation limits, linked to the code and review.

Habits

Start small

A focused tool with readable output and tests comes before anything bigger.

Write it down

Each project gets a note, so the reasoning is visible and not only the final code.

Test the failure path

Check what should be rejected as well as what should pass, and say what the evidence does not prove.

System design

How this site is built, checked and deployed.

Read the architecture
Content
Articles and project case studies are managed through structured files instead of hard-coded page data.
Deploy
GitHub Actions builds dist and deploys the artifact to GitHub Pages. Cloudflare provides the edge layer.
Security
No application login or database; a hashed Content Security Policy on every page. Browser assets and the build pipeline still need maintenance.
Generated
RSS, sitemap, share cards and structured data come from the same content records.

Languages

English
C1 Professional
German
C1 Advanced Academic
Mandarin
Native
Hokkien
Fluent
Japanese
A2 Elementary

Personal interests

Photography
I shoot portraits, everyday street scenes and landscapes on a Nikon D750.
Athletics & fitness
Football, skateboarding, basketball, badminton and volleyball, plus regular strength training.
Global insight & cycling
Recreational off-road cycling. I also follow geopolitics, investing and global markets.

Contact

Questions about a project, a pull request or an opportunity: email reaches me directly. I work in English and German.

Haitao Zheng

EN DE