2026-04
HackerOne · Public Program
Session-invalidation chain: refresh-token rotation without prior-token invalidation, logout endpoint cosmetic-only.
High · CVSS 8.1acknowledged
Disclosures
Findings.
Public security findings and responsible-disclosure work. Every line is a story, every story is verifiable.
2026-04
HackerOne · Public Program
Six exported Android activities without caller verification, enabling cross-app UI spoof with zero-permission PoC.
Medium · CVSS 5.0disclosed
2026-04
Responsible Disclosure · Private
Open CORS forwarder chained through cloud metadata to service-account token, granting broad read-access to the tenant.
Critical · CVSS 9.8fixed
2026-03
Private RDP · Retail
Unauthenticated GraphQL path enabled enumeration of ~58M user profiles via single alias-batched request.
Medium · CVSS 5.3acknowledged
Hall of Thanks
Acknowledgements
Programs and companies that acknowledged clean responsible-disclosure work.
- HackerOne Hall of Thanks
- Amazon Vulnerability Research Program
- Multiple private programs (NDA-bound)
Ready for a real assessment?
Short scoping call, clear proposal, kick-off in two to four weeks.
Start the conversation