Haitao Zheng EN DE

Open-source work

Accepted fixes to cloud, security and infrastructure projects, with the reported failure, patch and review linked below.

Snapshot verified 2026-11-03. Includes code, tests and documentation. Own repositories, unmerged proposals and closed PRs are excluded. Check the live GitHub record ↗

Merged upstream PRs
34
Upstream repositories
7
Combined GitHub stars
70.5k
Open PRs in review
13

Merged intoPRsStars

  1. pyinfra-dev/pyinfra 16 6.1k
  2. aws-cloudformation/cfn-lint 11 2.6k
  3. prowler-cloud/prowler 3 15.2k
  4. aquasecurity/trivy 1 38.9k
  5. ansible/ansible-lint 1 3.9k
  6. trailofbits/graphtage 1 2.5k
  7. DataDog/guarddog 1 1.2k

Merged per month Jul–Nov 2026

7 Jul
7 Aug
11 Sep
9 Oct
0 Novto date
Snapshot verified Nov 3, 2026: merged pull requests by 0xTaoZ outside personal repositories; stars as of the same date.

CVE-2026-120829

Ansible. Reported to Red Hat Product Security, which assigned the CVE and credited me with the discovery.

Upstream fix in progress. Technical details will follow the public advisory.

Why contribute upstream?

I contribute fixes to open-source security and infrastructure tools. Returning a fix to the project lets other users receive it too, instead of keeping the same workaround in their own copy.

The work includes reading existing code, reproducing the problem, adding tests and going through review. The cases below link to the accepted patch so the change can be checked directly.

Read the contribution approach ↗

pyinfra #1945

Infrastructure / SSH

Support OpenSSH host certificates.

Problem
OpenSSH certificate-authority entries were skipped while loading known_hosts. A server signed by a trusted CA then appeared to be an unknown host under strict checking.
Change
Keep CA entries separately, then check the host pattern, certificate principal and validity period. Strict checking stays enabled.
Reason
Supporting the certificate format still requires checking whether that certificate is trusted.

Merged September 2026 · connector regression tests

Read the patch and review

cfn-lint #4704

Amazon Web Services (AWS)

cfn-lint / AWS CloudFormation

Validate CloudFormation lifecycle policies.

Problem
A bare Fn::Select used as a CreationPolicy or UpdatePolicy passed linting, but CloudFormation rejected it unless AWS::LanguageExtensions resolved it first.
Change
Check CreationPolicy and UpdatePolicy at the policy layer. Keep the shared Fn::Select resolver unchanged.
Reason
The rule belongs to the policy attribute; other uses of the function need to keep working.

Merged September 2026 · policy and intrinsic-function tests

Read the patch and review

Prowler #11837

Kubernetes / Security checks

Report Pods using hostPath volumes.

Problem
Pods can mount node filesystem paths with hostPath volumes. A useful check needs volume evidence from the Kubernetes service model.
Change
Collect Pod volume data and report one finding per Pod. Tests cover the collected data and the check.
Reason
The check can only evaluate volumes that the collector has kept in the Pod model.

Merged July 2026 · service collection and check tests

Read the patch and review

Merged pull requests

Checked on 2026-11-03

A count is only useful if it can be checked. Every entry below links to a merged upstream pull request, grouped by repository.

pyinfra-dev/pyinfra

16 merged, 6.1k stars

  1. fix(connectors.ssh): match host CAs on custom ports #1971
  2. fix(api): omit variadic kwargs from auto labels #1983
  3. fix(operations.git): allow chowned repo pulls #1982
  4. fix(api): strip su password prompt from fact output #1981
  5. fix(connectors.ssh): preserve nested ProxyJump sockets #1980
  6. docs(operations.files): warn rsync deletes extra files #1979
  7. fix(connectors.ssh): support sudo passwords with rsync #1950
  8. fix(cli): parse literal list arguments #1892
  9. fix(operations.bsdinit): enable OpenBSD services with rcctl #1916
  10. docs: fix connectors index link #1958
  11. fix(connectors.ssh): trust known_hosts certificate authorities Write-up: Supporting SSH host certificates in pyinfra #1945
  12. fix(connectors.ssh): retry NFSv4 ACL handover #1955
  13. docs(operations.server): mention shell executable #1941
  14. fix(operations.dnf): install pinned package versions #1913
  15. chore: deduplicate shellcheck lint command #1891
  16. fix(cli): preserve Windows paths in module errors #1884

aws-cloudformation/cfn-lint

11 merged, 2.6k stars

  1. fix(formats): register log group name validation correctly #4745
  2. fix(lambda): update SnapStart supported regions #4740
  3. fix: handle SAM RestApi stage references #4730
  4. fix: reject Fn::Select lifecycle policies without transform Write-up: Where I added the lifecycle policy check in cfn-lint #4704
  5. Allow Fn::GetAZs in Fn::Join values #4677
  6. Avoid maxProperties warnings for single-property schemas #4686
  7. Allow GetAtt outputs on SAM applications #4665
  8. fix(functions): allow FindInMap DefaultValue without transform #4628
  9. Warn for ignored SAM resource attributes #4620
  10. Validate Fn::Select negative indexes #4622
  11. Fix shared pricing defaults #4572

prowler-cloud/prowler

3 merged, 15.2k stars

  1. fix(sdk): report all-users 2sv override failures #12700
  2. fix(sdk): skip undescribed ECS task definitions Write-up: When a failed API call turned into a PASS in Prowler #12217
  3. feat(kubernetes): add hostPath volume check Write-up: Adding a hostPath check to Prowler #11837

aquasecurity/trivy

1 merged, 38.9k stars

  1. feat(java): read Jenkins plugin manifest licenses Write-up: Teaching Trivy where a Jenkins plugin declares its license #10939

ansible/ansible-lint

1 merged, 3.9k stars

  1. fix: var-naming for register projections Write-up: Checking register projection names in ansible-lint #5110

trailofbits/graphtage

1 merged, 2.5k stars

  1. Add INI filetype support Write-up: Adding INI files to Graphtage's semantic diff #120

DataDog/guarddog

1 merged, 1.2k stars

  1. Show PyPI Inspector link for remote PyPI findings Write-up: Adding clickable PyPI Inspector links to GuardDog output #797

Open pull requests

Checked on 2026-11-03

13 proposals waiting for maintainer review. They are not counted above until they are merged, and some may be closed without merging.

  1. fix(alibabacloud): detect ECS security group rules open to ::/0 prowler-cloud/prowler #12982
  2. fix(alibabacloud): read RDS whitelist from security_iplist prowler-cloud/prowler #12980
  3. Use bigint for PostgreSQL ASN fields certtools/intelmq #2729
  4. Handle bracketed URL netloc sanitization certtools/intelmq #2728
  5. Allow ASN database update to create missing file certtools/intelmq #2727
  6. fix(kubernetes): correlate secret rules with resourceNames bridgecrewio/checkov #7706
  7. fix(java): avoid eqeq false positives on null checks semgrep/semgrep-rules #4070
  8. fix(java): catch permissive file permission APIs semgrep/semgrep-rules #4069
  9. fix(sdk): skip M365 outbound preset policies prowler-cloud/prowler #12902
  10. Include py.typed in source distribution manifest Yelp/detect-secrets #974
  11. Suppress kernel startup stdout during execution nteract/papermill #900
  12. Fix UTF-8 scans under non-UTF-8 locales Yelp/detect-secrets #973
  13. Detect unsafe tarfile extract calls PyCQA/bandit #1457

I am a contributor to these projects, not their maintainer or an employee of the organizations behind them. Work still under review is visible on GitHub ↗.

Haitao Zheng

EN DE