Small builds the case. Big breaks the software.
A born-blind builder pair. One constructs the forensic specification and arms the attack; the other wields it and cracks real, top, vulnerable software — and every crack is proven, for real, in the sealed cage.
Two blind twins, one weapon transfer.
The forensic constructor
Builds the specification and its counter-specification — the load-bearing claim, the bar it must clear, the real weakness class. Then it arms the attack and hands it over, blind.
The cracker
Wields the armed tool against the real artifact. It executes, it cracks, it forges the kill-tool — and the sealed cage decides whether the exploit actually fired.
Neither twin can see the other's internals. The only thing that crosses between them is a stripped, born-blind weapon — so their signal never collapses into one correlated mind.
Real packages. Real weakness classes. Proven, not asserted.
| Target | Class | The real sink |
|---|---|---|
| node-serialize · CVE-2017-5941 | CWE-502 | untrusted deserialization runs code through eval() |
| minimist 1.2.0 · CVE-2020-7598 | CWE-1321 | --__proto__.x walked into Object.prototype |
| semver 5.3.0 · CVE-2022-25883 | CWE-1333 | version-range regex built unbounded (ReDoS) |
| ejs 2.5.5 | CWE-94 | template compiled into a JS function (RCE class) |
| marked 0.3.6 | CWE-79 | the javascript: URL-scheme guard bypassed |
| Zip-Slip resolver | CWE-22 | a ../ entry escapes the extraction root |
Each is a real, published weakness class. The pair reads the literal bytes, forges a real kill-tool, and the cage confirms the flaw fires — then builds the fix that closes it without regressing the safe path.
Run blind against a public cyber-reasoning benchmark.
Challenge projects analysed blind — a proof-of-vulnerability is a real input that trips a sanitizer, and a patch must stop it and pass the project's own tests.
Heap-buffer-overflow, use-after-free, out-of-bounds read — each a real crash the sanitizer observed, un-fabricatable, then patched and re-verified. Every finding banked with its receipt.
See the receipts, or read the law.
The Un-Fabricatable Catalogue
Every reconstruction as a receipt — a name, and an acceptance.
Open ⟶ →The Un-Fabricatable Referee
The constitution the whole company answers to.
Read ⟶Small and Big and the associated works are proprietary intellectual property of GUTS BNL. Gilad Dayag, sole author, creator, and owner. Security work is defensive — published weakness classes and owned or authorized targets only; no reproduction-enabling detail is disclosed. © 2026 GUTS BNL.