DOCUMENT ID: HUNGSEC-SPEC-2026-R4 · CLASSIFICATION: PUBLIC

Public Service & Product Documentation

This specification defines the primary cybersecurity services, source-assisted penetration testing methodologies, authorization governance, and sandbox containment controls operated by HungSec Labs (legal entity: Nguyen Thanh Hung, Registration No. 0109842615, Hanoi, Vietnam). Cybersecurity testing and vulnerability research constitute our core business operations.

1. Scope of Cybersecurity Services & Product Lines

HungSec Labs delivers specialized offensive security assessments and maintains open-source static analysis tooling for application and AI agent security teams:

Service / Product Line	Technical Assessment Scope	Standards & Engineering Deliverables
Source-Assisted Web & API Penetration Testing	Multi-tenant authentication & session state, RBAC/ABAC privilege escalation (CWE-269), SSRF, arbitrary file upload (CWE-434), insecure deserialization, and SQL/NoSQL injection.	OWASP WSTG v4.2, PTES; Full technical report with deterministic reproduction scripts and unified patch diff.
Static/Dynamic Vulnerability Research & CVD	AST sink-to-source taint analysis across PHP, TypeScript/Node.js, Python, and Java codebases, paired with containerized dynamic exploit verification.	Coordinated Vulnerability Disclosure (CVD) via Wordfence CNA and MITRE CVE assignment.
Adversarial Red Team & AI Runtime Auditing	Authorized adversary simulation against replica environments and static security scanning of Model Context Protocol (MCP) servers via our open-source analyzer (`mcp-guard`).	NIST SP 800-115; Remediation verification and CI/CD regression rules.

2. Authorization Governance & Rules of Engagement (RoE)

Every offensive security assessment and vulnerability verification workflow at HungSec Labs is bound by strict pre-engagement authorization controls:

Written Scope & Counter-Signed RoE: Testing only commences after a written Rules of Engagement (RoE) is signed by the system owner and Principal Security Researcher Hung Nguyen, enumerating exact target repositories, container images, hostnames, and permitted testing windows.
Replica & Ephemeral Testbed Execution: Exploit proof-of-concept development and fuzzing are conducted exclusively against local Docker/Hyper-V replica instances. Autonomous or semi-autonomous testing is never pointed at live production systems or critical infrastructure.
90-Day Coordinated Disclosure Policy: When researching third-party or open-source software, findings are disclosed privately to the vendor or designated CNA (such as Wordfence Threat Intelligence) with a complete root-cause analysis and suggested patch diff prior to public release.

3. Sandbox Architecture & Operator Security Controls

In accordance with industry best practices and Anthropic Cyber Verification Program (CVP) Exhibit A security requirements, all AI-assisted vulnerability analysis and exploit validation environments enforce hardware-backed identity and network isolation:

Control Domain	Implementation Specification
Phishing-Resistant MFA	All operator accounts, source control, and verification portals enforce FIDO2/WebAuthn passkeys and hardware security keys.
Credential Hygiene & Injection	No long-lived API keys or target secrets are stored inside assessment containers or git repositories. Model API requests are routed through an external proxy using short-lived session tokens.
Network Egress Allow-Listing	Assessment VMs and containers run on isolated virtual bridges with default-deny outbound firewall rules, permitting traffic only to local target replicas and the model API gateway.
Audit Logging & Retention	Full model prompt/completion transcripts, command execution logs, and network flow records are retained in immutable storage for a minimum of 30 days.

4. Sample AST Taint & Verification Specification

During source-assisted audits, HungSec Labs models untrusted user input sources against sensitive execution or persistence sinks before attempting dynamic confirmation inside the isolated testbed:

// HungSec Taint Rule Specification — CWE-269 / Arbitrary User-Meta Key Injection
rule "wp-unfiltered-usermeta-key-escalation" {
  source:  http_post_param("$_POST['type']"), http_post_param("$_POST['postid']")
  sanitizer_missing: allowlist_check(["rsvp_yes", "rsvp_maybe", "rsvp_invited"])
  sink:    wp_function("update_user_meta($user_id, $meta_key, $meta_value)")
  condition:
    $meta_key == "wp_capabilities" && contains($meta_value, "administrator")
  verification_env: "docker://hungsec-wp-sandbox:6.5-isolated"
}

5. Verified CVE Track Record & References

HungSec Labs maintains a publicly verifiable track record of high- and critical-severity vulnerabilities discovered by and credited to founder Hung Nguyen (Nguyen Hung) within the last 12 months:

CVE-2026-3844 (CVSS 9.8 Critical): Breeze Cache <= 2.4.4 — Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote (Published April 23, 2026; Credited to Hung Nguyen).
CVE-2026-11616 (CVSS 8.8 High): Events Calendar for GeoDirectory <= 2.3.28 — Authenticated (Subscriber+) Privilege Escalation via ajax_ayi_action (Published June 9, 2026; Credited to Nguyen Hung).