Breaking down a client-side bug chain, impact proof, and safe remediation notes.
DOM Clobbering to Account Takeover
Blog
Latest posts
Write-ups, disclosure notes, CTF learnings, and practical security research logs.
Hunting IDOR at Scale
A repeatable approach for finding authorization gaps in modern API surfaces.
Lessons from CVE Disclosure
What changed between initial report, vendor coordination, patch release, and advisory.