Skip to content

Instantly share code, notes, and snippets.

View mbijon's full-sized avatar
🎯
Focusing

Mike Bijon mbijon

🎯
Focusing
View GitHub Profile
@mbijon
mbijon / xss_clean.php
Last active February 17, 2026 23:16
XSS filtering in PHP (cleans various UTF encodings & nested exploits)
<?php
/*
* XSS filter, recursively handles HTML tags & UTF encoding
* Optionally handles base64 encoding
*
* ***DEPRECATION RECOMMENDED*** Not updated or maintained since 2011
* A MAINTAINED & BETTER ALTERNATIVE => kses
* https://github.com/RichardVasquez/kses/
*
* This was built from numerous sources
@mbijon
mbijon / ci_version_check.py
Created December 21, 2025 20:59
CI version check on python package versions
###
# CI check to prevent version regression
# Fail builds if NLTK is below the fixed version.
###
import nltk
from packaging.version import Version
MIN_SAFE = Version("X.Y.Z") # set to your validated fixed version
if Version(nltk.__version__) < MIN_SAFE:
raise SystemExit(f"NLTK too old: {nltk.__version__} < {MIN_SAFE}")
@mbijon
mbijon / mitigation.py
Created December 21, 2025 20:45 — forked from sethmlarson/mitigation.py
Mitigation for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, and CVE-2024-12718
import pathlib
# Avoid insecure segments in link names.
# 'tar' is a tarfile open for reading.
for member in tar.getmembers():
if member.linkname and '..' in pathlib.Path(member.linkname).parts:
raise OSError("Tarfile with insecure segment ('..') in linkname")
# Now safe to extract members with the data filter.
tar.extractall(filter="data")
@mbijon
mbijon / repo-security-patterns-scan.sh
Created December 4, 2025 04:07
Repo security pattern search commands
# Secrets, Evals, and Unsafe practices
grep -r "password\|secret\|api_key\|token" /repo -e .env -e .env.local --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" 2>/dev/null | head -20
grep -r "http://" /repo/src --include="*.ts" --include="*.tsx" 2>/dev/null | grep -v "https://" | head -20
grep -r "(eval|Function)\(|dangerouslySetInnerHTML|__html|v-html" /repo 2>/dev/null | head -20
grep -r "public/**/*.html" /repo 2>/dev/null | head -20
grep -r "localStorage|sessionStorage|document\.cookie" /repo 2>/dev/null | head -20
grep -r "userAgent|navigator\." /repo 2>/dev/null | head -20
grep -r "maxLength|minLength|pattern=|validation|sanitize" /repo/src/components 2>/dev/null | head -20
# JS and NPM
@mbijon
mbijon / bash_export.sh
Created September 10, 2025 02:03
Use Kimi model by Moonshot in Claude Code. This function shims your .bashrc/.zshrc
# Shim the Kimi model by Moonshot into Claude Code
export ANTHROPIC_AUTH_TOKEN={Your Kimi / Moonshot API key}
export ANTHROPIC_BASE_URL=https://api.moonshot.ai/anthropic
@mbijon
mbijon / disable-xss-auditor.sh
Created September 19, 2016 19:04
CLI command to start Chrome with XSS Auditor disabled. Use for XSS/security testing
'/Applications/Google Chrome.app/Contents/MacOS/Google Chrome' --disable-xss-auditor --enable-devtools-experiments --disable-features=enable-automatic-password-saving
@mbijon
mbijon / reflection.md
Created August 16, 2025 00:12 — forked from a-c-m/reflection.md
reflection.md - a way to have claude-code self improve its context.

You are an expert in prompt engineering, specializing in optimizing AI code assistant instructions. Your task is to analyze and improve the instructions for Claude Code. Follow these steps carefully:

  1. Analysis Phase: Review the chat history in your context window.

Then, examine the current Claude instructions, commands and config <claude_instructions> /CLAUDE.md /.claude/commands/*

@mbijon
mbijon / WP_rolling_transient.php
Created November 4, 2012 07:52
Rolling expiration with WordPress Transients: Each time the transient is accessed the expiration is delayed. Intended for rate-limiting (be careful not to share a transient btw multiple users). Might work better for micro-caching in the event a flood is n
$call_limit = 350; // API calls (in an hour)
$time_limit = 60 * 60; // 1 hour (in seconds)
$transient_name = $host . "_rate_limit"; // Using their host name as the unique identifier
// Check to see if there are any transients that match the name, if not create a new one
if ( false === ( $calls = get_transient( $transient_name ) ) ) {
$calls[] = time();
set_transient( $transient, $calls, $time_limit ); // Use an array of time() stamps for rolling effect
} else {
// There is already a transient with this name
@mbijon
mbijon / agent loop
Created March 14, 2025 18:01 — forked from jlia0/agent loop
Manus tools and prompts
You are Manus, an AI agent created by the Manus team.
You excel at the following tasks:
1. Information gathering, fact-checking, and documentation
2. Data processing, analysis, and visualization
3. Writing multi-chapter articles and in-depth research reports
4. Creating websites, applications, and tools
5. Using programming to solve various problems beyond development
6. Various tasks that can be accomplished using computers and the internet
@mbijon
mbijon / fft.php
Last active February 13, 2025 15:13
Fast Fourier Transform in PHP
<?php
// !!! Warning: for reference, not debugged
###################################################################
# PHP_Fourier 0.03b
# Original Fortran source by Numerical Recipies
# PHP port by Mathew Binkley (binkleym@nukote.com)
###################################################################