47
Reports
3
Confirmed
8
Informative
12
Duplicates
1
Out of scope
16
Pending
7
Not applicable
Severity snapshot
Critical 0 · High 0 · Medium 1 · Low 2
Recent work
Bad-debt exit ordering strands later stakers in a staking protocol
Smart-contract logic · Pending triage · Pending
Exit queues need ordering guarantees — whoever leaves last should not absorb everyone else's bad debt.
Emergency exit misattributes undistributed staking rewards
Smart-contract logic · Pending triage · Pending
Emergency paths must settle accounting first, or rewards silently land in the wrong place.
Over-permissioned client-side search keys expose non-production content
Web applications · Low · Informative
Client-side keys inherit every permission you forget to scope — check what they can read, not just what the UI shows.
Payment gateway marks underpaid orders as paid
APIs · Medium · Confirmed
Never trust the amount from the client — reconcile what was charged against what was owed server-side.
Subdomain takeover via a dangling CNAME
Web applications · Low · Informative
DNS outlives the services it points to — audit dangling records before someone else claims them.
WebSocket origin allowlist bypass (cross-site WebSocket hijacking)
Real-time systems · Pending triage · Pending
An origin check that can be bypassed is worse than none — it hides the real attack surface.
Map the surface
Understand scope, assets, entry points, and trust boundaries before testing.
Validate the behavior
Reproduce the smallest meaningful security impact without unnecessary access or traffic.
Write useful evidence
Document the request shape, result, impact, and a short path for triage.
I keep public notes focused on the lesson rather than private program details. Read the related security research writing.