01 / Named source
Cwtch
Open Privacy Research Society
The Cwtch 1.17.2 release notes thank Eduardo Camarillo for reporting several security issues addressed in that release.
Public security
attributions
A source-linked record of acknowledgments published by third-party projects and related remediation evidence.
This page excludes self-published work and assessments of Profullstack projects. Inclusion is based on public, first-party evidence rather than inferred association.
Verified 02 October 2026
Independent disclosures / vendor acknowledgments
Each entry points to a source published by the project that explicitly names Eduardo Camarillo.
02 / Named source
StealthRelay
Olib AI
The project credits Eduardo Camarillo for two reports: an IPv4-mapped IPv6 policy bypass and exposure of the claim page on the health and metrics listener. Both were addressed in v0.5.3.
03 / Named source
PrivacyNotes.app
Lifetime Labs
The project acknowledges an unsolicited review by Eduardo Camarillo, summarizing six defects and one documented limitation. Four defects were fixed in v0.522.1; the record also notes a threat-model correction and one accepted residual limitation.
The full assessment preserves the researcher’s issue taxonomy. The project acknowledgment uses its own public accounting. Advisories credited to other researchers in the same SECURITY.md are not claimed here.
Advisory and remediation linkage
Attribution linked to the GitHub profile
Phase Console
GHSA-68r4-53vq-4fqm · v2.73.2GHSA-68r4-53vq-4fqm records accepted reporter credit for Noir0x63. The public identifier alone does not establish a link to the current Noir-0x63 account.
Verification standard
Named acknowledgment. A first-party project source explicitly identifies the researcher and connects the name to reported security work.
Remediation linkage. Public project records connect an advisory to a corrective change and release, but are not represented as personal credit without a confirmed naming source.