Profile

This is the portfolio site of Kai Mitsuzawa (光沢加偉).

My education, work experience and other background are listed below.

Education

I currently research software supply chain security in the field of cybersecurity.

2019-2021 N High School
- Member of the Investment Club and the Politics Club.
2021-2025 Keio University, Faculty of Environment and Information Studies (SFC)
- Murai Joint Research Lab, Tezuka Lab (cybersecurity)
- Kokuryo Lab (business)
- WIDE Project ID:2182 Site: https://web.sfc.wide.ad.jp/~kaizawa97

Presentations given as a member of the Tezuka Lab.

2024/10/24(Thu) CSS (Computer Security Symposium 2024)
- 3F2-1: Defining and Visualizing Security Risks in Source Code Development to Support Decision-Making by OSS Users
- CSS Encouragement Award / OWS Research Award
- URL: https://www.iwsec.org/css/2024/program.html#3F2
- Workshop on OSS Security (OWS): https://www.iwsec.org/ows/2024/
2022/10/25(Tue) CSS (Computer Security Symposium 2022)
- 2B-III-5: An npm Package Manager Add-on that Visualizes How Source Code is Managed
- URL: https://www.iwsec.org/css/2022/program.html#2B-III
- IPSJ Digital Library: http://id.nii.ac.jp/1001/00223035/

Vulnerabilities I have reported and fixed.

2026/02/27 CVE-2026-28231 | pillow-heif
- Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
- Moderate (CVSS 5.5) / fixed in 1.3.0
- Advisory: GHSA-5gjj-6r7v-ph3x
2026/02 - Present | Google Bug Hunters
- Reporting vulnerabilities to the Google VRP (Vulnerability Reward Program)
- Profile: https://bughunters.google.com/profile/09a82b79-a958-4996-8ef9-9281044c573c
2026/03/06 Firecracker
- fix(mmds): validate tcp opt len
- A TCP option length was accepted without validation, contrary to RFC 9293 (MUST-7). Reported.
- Commit: fa3e4d7
2026/08/05 KiroCrew
- fix(security): any local web page could open a shell through the terminal WebSocket
- The terminal WebSocket performed no origin validation, so any local web page could open a shell via Cross-Site WebSocket Hijacking (CSWSH). Reported and fixed.
- PR: kirodotdev/KiroCrew#1534
2026/08/13 KiroCrew
- fix(security): an imported settings archive could schedule arbitrary shell commands
- Cron commands were not re-validated when a settings archive was imported, allowing arbitrary command execution from a crafted archive (CWE-502 / CWE-862). Reported and fixed.
- PR: kirodotdev/KiroCrew#1627

Internships and entrepreneurial work. For the latest information, please see my LinkedIn.

2025/10 - Present | Amazon Web Services (AWS)
- Solutions architect
2022/12 - Present | Jelper Club
- Site: Jelper Club, Inc. — for companies
- Site: Jelper Club, Inc. — for students
2022/09 - 2025/07 | Coincheck
- Security Engineer (Internship)
- Site: Coincheck, Inc.
2022/02 - 2023/03 | ARTERIA Networks Corporation
- Security Engineer (Internship)
- Site: ARTERIA Networks Corporation
2022/01 - 2023/03 | The Murakami Family Foundation
- Community service (Internship)
- Site: The Murakami Family Foundation
2021/07 - 2021/09 | NHK, Japan Broadcasting Corporation
- System Engineer (Internship)
- Tokyo2020 Olympic Games
2021/04 - 2021/07 | Monolith Works
- Security Engineer (Internship)

An overview of the training courses I have taken.

CYDER (Cyber Defense Exercise with Recurrence) 2022, Course A
- Hosted by the Ministry of Internal Affairs and Communications and NICT (National Institute of Information and Communications Technology) CYDER
- Gathered knowledge on incident response and CSIRT operations.
CYDER (Cyber Defense Exercise with Recurrence) 2023, Course B-2
- Hosted by the Ministry of Internal Affairs and Communications and NICT (National Institute of Information and Communications Technology) CYDER
- Carried out incident response hands-on, building a practical understanding of CSIRT operations.

An overview of my skills.

A list of my certifications.

A list of links.

Media appearances are listed on the Media page.