Nofil Qasim
Senior Software Engineer - Security
SkyLabs AI
Vulnerability researcher with experience in exploit development, vulnerability discovery, mitigation bypass, and exploit analysis. I mainly work on Linux and UNIX systems and research 0-days in proprietary software through private disclosure. I have also worked on evasive malware for Windows. Publicly disclosed findings include a sudo intercept bypass, a stack-based buffer overflow in Coinbase’s MPC library, and a heap-based out-of-bounds write in Steam Audio. My interests include binary exploitation, kernel vulnerabilities, interpreter and runtime security, WASM security, microarchitectural security, and systems programming.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Scanipy: Refactor-Invariant Identity and Provable Provenance for Static Analysis
SAST tools are good at finding bugs, but they often struggle to keep track of those bugs as the code changes. A finding tied to a source location or text hash can get a new ID after a variable rename, formatting change, helper extraction, or file move. That breaks suppressions and triage history. Re-running a scan can also produce different output, which makes it difficult to use SAST results as audit evidence or reliable CI gates.
Scanipy is an open-source platform for tracking and verifying SAST findings across code changes. It runs existing engines such as Semgrep and CodeQL and adds three things:
Stable finding identity. Scanipy builds a fingerprint from the finding's code-dependence slice using graph canonicalization instead of a text hash. The identity remains stable across renames, formatting changes, code reordering, method extraction, and file moves, but changes when the underlying issue is actually fixed.
Reproducible results. Scans run in a pinned environment and are checked by a partitioned attestor to verify that repeated runs produce byte-identical results.
Signed provenance. Each finding has a machine-checkable chain linking it back to the source commit.
The demo will use a public repository. We'll scan it, make several refactors, and compare how Scanipy, CodeQL, and Semgrep track the resulting findings. We'll also verify two byte-identical runs and inspect the signed provenance for a finding.
Scanipy is available as a one-command Docker deployment so attendees can run it themselves.
Session Outcomes
- Why SAST finding IDs change after refactors, and how graph-based identity keeps the same finding linked to its previous triage and suppression history.
- How to make static-analysis results reproducible enough for audit use and CI enforcement, while separating what is guaranteed by the system from what depends on the analysis engine.
- How to evaluate new and AI/LLM-generated detection rules using an anytime-valid statistical precision guarantee instead of fixed thresholds.
- A runnable, self-hostable, open-source implementation that attendees can deploy themselves.
- 14:40
- Tue
- 01 Dec
Stage:
Arsenal 2
Sessions Type:
Keynote