Featured Essay · Commentary
How the bug bounty industry's third-party loophole leaves real users exposed.
Research · Web App
A client-side input filter on a fleet management portal's search function looked solid — until I encoded the payload. A walkthrough of how Google dorking, a filter bypass, and an obscure event handler combined into a confirmed reflected XSS.
Research · Mobile
Android APKs are zip archives. Everything inside them — including secrets developers assumed were hidden — is one decompile away from being readable. A walkthrough of mobile recon methodology for extracting hardcoded credentials from production apps.
Security Researcher & Consultant
Independent security researcher focused on web applications, APIs, and network-exposed services. All research is conducted ethically within authorized bug bounty programs. Read more →