Celeste Jessin
| Celeste Jessin | |
|---|---|
 Jessin in 2025 | |
| Born | January 27, 2006 Paris, France |
| 🏳️ Nationality | French |
| Other names | vmfunc; lillie |
| 💼 Occupation | |
| Known for | SIF framework; WebAuthn research; Hacktivism; vulnerability commentary |
| 🌐 Website | vmfunc |
Celeste "vmfunc" Jessin (born January 27, 2006) is a French ethical hacker, entrepreneur, and software developer who goes by the online handle vmfunc and sometimes lillie. Jessin gained recognition for security research contributing to tooling used for the discovery of CVE-2024-45489, a critical vulnerability in the Arc browser that received coverage in major technology publications.[1][2] Jessin created the penetration-testing framework SIF, has published work on the FIDO2/WebAuthn ecosystem, and has engaged in digital privacy and AI alignment and has been recognized by established cybersecurity organizations including vx-underground.[3] . According to its personal site, it is “mostly known for exploit/security research works, but currently doing stuff with AI and alignment.”[4] Jessin funded Lunchcat, described as "the AI-Powered security company."[5]
Early life
Jessin was born on January 27, 2006, in Paris, France. According to their profile, Jessin began making video-game cheats in their youth before shifting focus toward broader security research and AI alignment.[6] Jessin became involved with Internet Relay Chat (IRC) networks during their early teenage years and has lived in the United States, Switzerland, and Germany.
Career and research
Security research and vulnerability discovery
In June 2024, Jessin flagged privacy concerns with the Arc browser’s logging practices alongside researcher @xyz3va.[7]. Jessin contributed to tooling that allowed security research that identified privacy concerns with the Arc browser's logging practices, working alongside researcher xyz3va.[8] The related vulnerability (CVE-2024-45489) was disclosed and confirmed by The Browser Company in an official incident report.[9] The vulnerability received coverage from major technology publications including The Verge, ZDNet, and other technology media outlets.[10][11][12] Commentary using Jessin’s visuals appeared in content by @firesip_dev. [13]
Professional affiliations and recognition
Jessin has been recognized by vx-underground for contributions to CSS injection vulnerability research.[14] Following the initial CSS injection discovery in GitHub by security researcher cloud11665, Jessin identified additional attack vectors within GitHub's README file system.[15][16] The vulnerability exploited MathJax's LaTeX rendering system and received widespread attention in the cybersecurity community.[17] [18]
The Supabase official blog has featured Jessin's work, describing their role at "Lunchcat, the AI-Powered security company" in the context of security tooling and responsible disclosure contributions.[19]
Jessin has worked at established technology companies including Turing Pi and Thales Group, and according to their profile, has "funded an AI company."[20]
Software development
In 2024, Jessin created SIF (Security Inspection Framework), a penetration-testing suite written in Go.[21][22] The project was first hosted under the Lunchcat GitHub organization before moving to their personal account.[22] Jessin has described it as its intellectual property. [citation needed]
Technical publications and research
Jessin maintains a technical blog at vmfunc.gg featuring research posts including work on ARM64 hypervisor internals and transformer architectures.[23] They are a member of Nullpt.rs, a collaborative technical research blog.[24]
Lunchcat, Inc.
The SIF project is associated with the Lunchcat organization on GitHub.[21] Supabase's official blog references Lunchcat as "the AI-Powered security company [Jessin] works for," in the context of SIF-related hardening work.[25] Lunchcat is listed on LinkedIn under computer/network security.[26]
Bug bounty and security groups
Jessin co-led the bug bounty group Kenshu and is a founder of UD2.RIP, described as a non-profit reverse engineering and "flag hatching" group.[27][28]
Other projects
PsyLog (psylog.net) is a journaling and tracking application developed by Jessin that allows users to record personal data such as medications and substances; the site states it is free to use and that "all data remains on your device."[29]
Technical infrastructure and advocacy
According to their site, Jessin operates their own ASN and ISP.[30] Jessin has maintained a user page under the name “Lillie” on the wiki of Metalab, a hackerspace that is part of the CCC, and has advocated for digital privacy and user rights.[31][32]. It has also advocated for digital privacy and user rights, including authoring an open letter addressed to the President of France in 2025.[33]
References
- ↑ "Researcher reveals 'catastrophic' security flaw in the Arc browser". The Verge. 2024-09-20. Retrieved 2025-09-15.
- ↑ "A catastrophic browser flaw is patched almost immediately". ZDNet. 2024-09-24. Retrieved 2025-09-15.
- ↑ "vx-underground Twitter recognition". X. 2024-06-07. Retrieved 2025-09-15.
- ↑ "Profile: vmfunc.gg". vmfunc.gg. Retrieved 2025-09-15.
- ↑ "Supabase Security Suite". Supabase. 2024-07-10. Retrieved 2025-09-15.
- ↑ "Profile: vmfunc.gg". vmfunc.gg. Retrieved 2025-09-15.
- ↑ ""your 'privacy-friendly' arc browser relies on firebase …"". X. 2024-06-12. Retrieved 2025-09-15.
- ↑ ""your 'privacy-friendly' arc browser relies on firebase …"". X. 2024-06-12. Retrieved 2025-09-15.
- ↑ "CVE-2024-45489 Incident Report". Arc Browser. 2024-09-19. Retrieved 2025-09-15.
- ↑ "Researcher reveals 'catastrophic' security flaw in the Arc browser". The Verge. 2024-09-20. Retrieved 2025-09-15.
- ↑ "A catastrophic browser flaw is patched almost immediately". ZDNet. 2024-09-24. Retrieved 2025-09-15.
- ↑ "Researcher discovers Arc browser vulnerability that could expose user data". The Indian Express. 2024-09-20. Retrieved 2025-09-15.
- ↑ "Firesip_dev video reference". X. 2024-06-01. Retrieved 2025-09-15.
- ↑ "vx-underground recognition of security research". X. 2024-06-07. Retrieved 2025-09-15.
- ↑ "diving into mathjax css injection attack". kennethnym.com. 2024-06-08. Retrieved 2025-09-15.
- ↑ "Github's CSS Injection Exploit Was Incredible!". YouTube. 2024-06-10. Retrieved 2025-09-15.
- ↑ "The GitHub CSS vulnerability saga". tinker.ph. 2024-06-08. Retrieved 2025-09-15.
- ↑ "This GitHub CSS Exploit Is WILD". youtube.com. 2024-06-11. Retrieved 2025-09-15.
- ↑ "Supabase Security Suite". Supabase. 2024-07-10. Retrieved 2025-09-15.
- ↑ "Profile: vmfunc.gg". vmfunc.gg. Retrieved 2025-09-15.
- ↑ 21.0 21.1 "lunchcat/sif repo". GitHub. Retrieved 2025-09-15.
- ↑ 22.0 22.1 "vmfunc/sif repo". GitHub. Retrieved 2025-09-15.
- ↑ "Blog: vmfunc.gg". vmfunc.gg. Retrieved 2025-09-15.
- ↑ "Nullpt.rs author page". Nullpt.rs. 20 June 2025. Retrieved 2025-09-15.
- ↑ "Supabase Security Suite". Supabase. 2024-07-10. Retrieved 2025-09-15.
- ↑ "Lunchcat company page". LinkedIn. Retrieved 2025-09-15.
- ↑ "UD2 members (archived)". Wayback Machine. 2025-08-27. Archived from the original on 2025-08-27. Retrieved 2025-09-15. Unknown parameter
|url-status=ignored (help) - ↑ "UD2 X profile (archived)". Wayback Machine. 2024-09-19. Archived from the original on 2024-09-19. Retrieved 2025-09-15. Unknown parameter
|url-status=ignored (help) - ↑ "PsyLog official site". psylog.net. Retrieved 2025-09-15.
- ↑ "Profile: vmfunc.gg". vmfunc.gg. Retrieved 2025-09-15.
- ↑ "Metalab user page: Lillie". metalab.at. 2024-01-17. Retrieved 2025-09-15.
- ↑ "Digital rights advocacy". X. 2025-08-28. Retrieved 2025-09-15.
- ↑ "Open letter tweet". X. 2025-08-28. Retrieved 2025-09-15.
External links
- Official website
- PsyLog project site
- vmfunc on GitHub
- Author page at Nullpt.rs
- @vmfunc on X (Twitter)
This article "Celeste Jessin" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Celeste Jessin. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
