Apache Software Foundation Member. I maintain Apache Camel and do security research across the Apache ecosystem. Based in Rome, at IBM.

Camel, mostly: the core framework, the Spring Boot and Quarkus runtimes, Kamelets, Camel K, and the website. Over the last twelve months that came to roughly 1,700 commits and 3,400 pull request reviews across 31 repositories.

The review half is the part that matters. A framework with 350+ components stays healthy because other people's patches land well, not because I write more of them.

42 CVEs credited to date, across Camel and twelve other Apache projects: Hadoop, Hive, Storm, Doris, Flink, Flink Kubernetes Operator, IoTDB, Zeppelin, Gravitino, Polaris, Fluss, and SkyWalking. The full table, with CWE classes and fixed-in versions, is in security-research.

Much of it is one bug class chased across unrelated codebases: untrusted input reaching a control plane that assumed it was trusted. In Camel that shows up as header injection, an inbound header the framework never filtered, steering a producer into SSRF, a cross-topic write, or a redirected SOAP operation. Elsewhere it wears different clothes. Other recurring findings:

• Fail-open authentication: policies that skip verification entirely when no roles are configured, so any forged token passes
• Unsafe deserialization: registry lookups, key-lifecycle handling, and legacy migration paths
• Information disclosure: stack traces returned to clients where the mute setting defaults wrong or a binding ignores it

Where I can I publish a minimal runnable reproducer, each naming the release that fixed it: 27 for my own findings, plus 20 more built for issues reported by other researchers.

I write most of this up on oscerd.github.io, including a weekly roundup of Java vulnerabilities.