About
Kartik Ganesh is a security researcher and enterprise technologist. He is the finder credited on CVE-2026-56671 (path traversal in ComfyUI), holds additional accepted security-advisory credits, and has spoken at BSides San Diego. By day he works with financial-services organizations on technical security, which gives him both the researcher's and the defender's view of what actually matters in a vulnerability report.
Sessions
32 Submitted, 2 Accepted: The Six Gates That Kill a Vulnerability Report
What you will learn:
1. A taxonomy of the most common reasons vulnerability reports get closed, with real examples rather than hypotheticals. 2. Six gate-questions that disqualify a non-finding in under a minute. 3. The single property shared by findings that actually get accepted: a control that is supposed to block the attack, shown to be bypassable. 4. A defender-side application: triaging inbound reports faster by pattern-matching the same noise. 5. The case for publishing your failure rate: honest post-mortems make you a sharper researcher than a highlight reel does.