SECURITY RESEARCH & RESPONSIBLE DISCLOSURE
A collection of security research, vulnerability assessments, and responsible disclosures conducted on systems and applications. Technical evidence is sanitized before publication.
Responsible Disclosure Status
Additional security findings are currently undergoing coordinated disclosure, verification, and remediation. Details will be published only after the relevant disclosure process is complete.
Evidence Archive
Case studies can include sanitized screenshots, PoC recordings, vendor responses, and disclosure timelines. Secrets such as passwords, JWTs, cookies, OTPs, API keys, and private account data are never intentionally published.
HTML Injection Vulnerability
Responsible disclosure concerning an HTML injection issue.
READ CASE STUDY →XSS Injection Vulnerability
Responsible disclosure concerning an XSS injection issue.
READ CASE STUDY →XSS Injection Vulnerability
Responsible disclosure concerning an XSS injection issue.
READ CASE STUDY →Session Remains Valid After Logout
The adidas security team confirmed the issue was known and under remediation.
READ CASE STUDY →Session Remains Valid After Logout
Zepto confirmed the issue was already known and under internal tracking.
READ CASE STUDY →Session Remains Valid After Logout
Graphy escalated the matter to the concerned team for investigation and resolution.
READ CASE STUDY →Improper Session Invalidation After Logout
Authenticated session remained valid after logout during controlled testing.
READ CASE STUDY →SQL Injection
SQL injection was verified against the documented TTD application endpoint.
READ CASE STUDY →Session Remains Valid After Logout
W3C reproduced the issue and confirmed that it was fixed.
READ CASE STUDY →JWT Remains Valid After Logout
CertPing confirmed the issue and deployed real-time access-token invalidation.
READ CASE STUDY →ONGOING RESEARCH
are currently in responsible disclosure / remediation processes. Public technical details will be added after coordination is complete.