Enno Gelhaus

What the job actually is

A C-level title here isn't about handing work to other people. The work is mine.

It covers security engineering and vulnerability research, trust and abuse, support and community, CI/CD, monitoring, CNA operations, and hiring.

I'm also the second-largest contributor to the core codebase, at 438 commits. My background is DevSecOps and platform engineering, and I still spend most of the week in code.

What that has produced

42 published advisories and 20 CVEs across the two programmes, seven of them critical, the highest scoring 10.0.

The largest cluster is server-side request forgery, eight advisories deep. That is not an accident of the codebase. A social scheduler exists to fetch and post things on your behalf, so making outbound requests to attacker-influenced URLs is its job description rather than a mistake in it. Bug classes that come from a product's shape have to be treated structurally, not one endpoint at a time.

One rule for everything I build

If the API can do it, the UI has to do it too.

I've seen too many tools ship a feature behind an undocumented endpoint and call it done. Anything only a maintainer can drive isn't finished. It costs more up front. I've never regretted it.