Writeups and field notes.
CVE notes, X threads, and anonymized field work. I write about the root cause, the impact, and the fix - not exploit steps against live systems.
All writeups
A Windows search connector Firefox did not flag
A .searchConnector-ms file escaped Firefox's executable warning list. The public record, the impact, and the fix.
Read writeupNTLM credentials and a race in Networking
A race condition in Firefox's NTLM handling could leak credentials to an untrusted host. The public record, the impact, and the fix.
Read writeupNotes from X.
Long-form findings from the timeline. The full technical detail stays in the thread.
How a public JS bundle led to a large IDOR
A public JavaScript bundle exposed the signing keys. A forged signature led to an IDOR and a lesson in why client-side secrets are not secrets.
Read on XJWT authentication bypass
The API decoded the token without verifying the signature. Changing one claim in the payload turned a 401 into a 200 and opened protected endpoints.
Read on X