Research
- 2026-10-24
How this blog works (and what I will not publish) - - - 2026-08-19
Hardcoded Azure App Configuration credentials in public JavaScript (candidate, unconfirmed impact) critical Cloud workspace platform (bounty cap 4,000 EUR) - 2026-08-19
Missing object-level authorization on a space-permissions API (candidate, blocked by test data) critical Simulation platform (bounty cap 6,000 EUR) - 2026-08-19
Open redirect via a backslash parser differential (three stacks, one landing page) low European daily-deals platform (Tier 2) - 2026-08-11
Anonymous user enumeration on a WordPress REST API via the ?rest_route= bypass low European telecom brand (Tier 2) - 2026-08-11
Email enumeration in a password-reset endpoint (200 vs 422 tells you who has an account) medium Large festival crew-accreditation platform (Tier 3) - 2026-08-11
No rate limiting on a login API: 30 failed attempts, zero 429s, 0.157 s mean latency high Large festival crew-accreditation platform (Tier 3)