Vasilii Ermilov
Security Researcher at Semgrep
Toronto, Ontario, Canada
Summary
🤩
Rockstar🎓
Top SchoolVasilii Ermilov is a Security Researcher and senior software engineer with a decade of experience delivering secure backend systems and developer-focused tooling from Toronto. He currently contributes to Semgrep, authoring detection rules for critical vulnerabilities like hardcoded JWT secrets, insecure access control, and command injection—work that combines deep secure-coding knowledge with practical static analysis expertise. His career spans embedded C for industrial controllers, enterprise RAD frameworks and Node.js modules, and hands-on IT support, giving him a rare blend of low-level systems, web backend, and end-user operational experience. A Russian native speaker who thrives both independently and in teams, he has a track record of translating security research into actionable rules used by the wider Semgrep community.
10 years of coding experience
9 years of employment as a software developer
Master's degree, Technical Systems Control and Computer Science Engineering, Master's degree, Technical Systems Control and Computer Science Engineering at Pacific State University
javascript, English, Russian
Github Skills (15)
it-security10
web-token10
javascript10
command-injection10
vulnerability-detection10
jsonwebtoken10
jwt10
security10
java9
ruby9
javas9
php8
go7
python7
scala6
Programming languages (15)
Github contributions (5)
semgrep/semgrep-rules
Mar 2020 - Jan 2023
Semgrep Community Edition rules, maintained by Semgrep and the community. Free to use under the Semgrep Rules License.
Role in this project:
Backend Developer & Security Engineer
Backend Developer & Security EngineerContributions:371 reviews, 408 commits, 545 PRs in 2 years 10 months
Contributions summary:Vasilii's commits focus on implementing security rules related to common vulnerabilities such as hardcoded JWT secrets, insecure access control, and command injection. These changes encompass adding and modifying rules for identifying these vulnerabilities, along with providing example code snippets to illustrate the identified issues. The contributions demonstrate expertise in secure coding practices and the ability to identify and address security weaknesses in various backend technologies, including Java, JavaScript, and Ruby.
semgrepstatic-analysisgrep-likeprogram-analysissecurity
inkz/ermilov.dev_beta
Jan 2021 - Jun 2026
Contributions:20 pushes, 1 branch in 5 years 5 months
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.