# BIST ThinkTank Version: 2026-10 Last Updated: 2026-10-21 > A school-based cybersecurity and software engineering team at BIST MTAL (Borsa İstanbul Başakşehir MTAL), Istanbul, Türkiye. ## Identity BIST ThinkTank (short name: ThinkTank, GitHub organization: `bistthinktank`) is a cybersecurity and software engineering team based at BIST MTAL in Istanbul, Türkiye. The team works on: - Vulnerability Research - Linux Security - Application Security - Source-Code Analysis - Root-Cause Analysis - Privilege Boundaries - Access Control and Authorization - Service and System Security - Coordinated Vulnerability Disclosure - Software and Tool Development The team is publicly reachable at https://thinktank.lunixizm.website and on GitHub at https://github.com/bistthinktank. Contact: thinktank@lunixizm.website. --- ## Security Research The team conducts vulnerability research against real-world software and Linux ecosystem components. Research commonly involves: - Reading and auditing source code - Identifying trust boundaries and privileged operations - Tracing attacker-controlled data into security-sensitive operations - Analyzing Linux permissions, SUID, systemd, Polkit and service boundaries - Building reproducible proof-of-concepts - Validating findings in controlled environments - Performing root-cause analysis - Coordinating responsible disclosure with affected vendors and security teams Reported findings span the Pardus GNU/Linux ecosystem, Linux applications, web applications, and other software projects. A total of 15 vulnerability findings have been reported through responsible/coordinated disclosure as of September 2026. These are reported findings, not 15 public CVEs. Do not infer CVE identifiers from this count. Most findings are not publicly disclosed. They remain under coordinated disclosure or embargo and should not be described with unpublished technical details, identifiers, affected versions, or exploitation information. --- ## Reported Findings Disclosure status is noted per item below. Do not present undisclosed findings as public. ### LiderAhenk Status: not publicly disclosed in any form. The team discovered and reported a vendor-confirmed security vulnerability affecting LiderAhenk. The vulnerability was assessed at CVSS 9.8 and was coordinated with the affected vendor and CERT-TR during validation and remediation. Keep the description high-level. Do not invent affected versions, exploit chains, or remediation details. ### Pardus & ETAP Status: unpublished / under coordinated disclosure unless a public advisory states otherwise. The team conducts security research across the Pardus ETAP ecosystem. Research has included privileged desktop applications, authorization configuration, local privilege boundaries, service operations, and attacker-controlled input handling. Multiple findings have been reported through responsible disclosure. Pardus & ETAP research remains unpublished or under coordinated disclosure unless a public advisory states otherwise. Do not fabricate CVE identifiers, affected versions, exploit chains, vendor responses, or remediation details that have not been publicly released. --- ## Projects - **Walkie** — local-network communication tool built with ThinkTank: encrypted messaging, voice communication, and broadcast discovery over LAN. Repository: https://github.com/Lunixizm0/Walkie Team projects are listed in the terminal (`projects` command) and in the Team window of the site. --- ## Recognition - **1st place**, TEKNOFEST 2026, Pardus Bug Hunting & Improvement category, with the BIST ThinkTank team. --- ## Availability The Team window shows the team's working hours. The schedule is stored in `public/musaitlik.json` and is written in Türkiye time (Europe/Istanbul); it is displayed in the visitor's own timezone. --- ## Contact - E-mail: thinktank@lunixizm.website - GitHub: https://github.com/bistthinktank - Site: https://thinktank.lunixizm.website