{ "version": "https://jsonfeed.org/version/1.1", "title": "Hackicker · security research", "description": "Credited vulnerability findings and technical writing. Original sources linked.", "home_page_url": "https://hackicker.com/", "feed_url": "https://hackicker.com/feed.json", "language": "en", "authors": [ { "name": "Warisjeet Singh (sin99xx)", "url": "https://sin99xx.com/" } ], "items": [ { "id": "https://hackicker.com/findings#noscript-patch-propagation", "url": "https://hackicker.com/findings#noscript-patch-propagation", "title": "Tor Browser / NoScript: content-patch propagation", "content_text": "Incomplete propagation of NoScript’s content patches across DOM changes. Fixed in NoScript 13.6.35 and shipped in Tor Browser 15.0.24. Reported through HackerOne by Warisjeet Singh (sin99xx), credited in NoScript’s changelog.", "date_published": "2026-09-30T03:24:19.881Z", "date_modified": "2026-09-30T03:24:19.881Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)", "url": "https://sin99xx.com/" } ], "tags": [ "vulnerability research", "NoScript", "Tor Browser" ], "_sources": [ { "name": "NoScript changelog", "url": "https://noscript.net/changelog/" }, { "name": "Tor 15.0.24 release", "url": "https://blog.torproject.org/new-release-tor-browser-15024/" }, { "name": "Tor issue #45371", "url": "https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45371" } ] }, { "id": "https://hackicker.com/findings#noscript-onion-aliases", "url": "https://hackicker.com/findings#noscript-onion-aliases", "title": "Tor Browser / NoScript: onion-alias policy matching", "content_text": "NoScript site parsing did not account for Tor onion aliases. Fixed in NoScript 13.6.35 and shipped in Tor Browser 15.0.24. Reported through HackerOne by Warisjeet Singh (sin99xx), credited in NoScript’s changelog.", "date_published": "2026-09-30T03:24:19.881Z", "date_modified": "2026-09-30T03:24:19.881Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)", "url": "https://sin99xx.com/" } ], "tags": [ "vulnerability research", "NoScript", "Tor Browser" ], "_sources": [ { "name": "NoScript changelog", "url": "https://noscript.net/changelog/" }, { "name": "Tor 15.0.24 release", "url": "https://blog.torproject.org/new-release-tor-browser-15024/" }, { "name": "Tor issue #45368", "url": "https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45368" } ] }, { "id": "https://hackicker.com/findings#noscript-ipv4-matching", "url": "https://hackicker.com/findings#noscript-ipv4-matching", "title": "NoScript: IPv4 policy matching", "content_text": "Incorrect IPv4 address matching in NoScript’s policy engine. Fixed in NoScript 13.6.34. Reported through HackerOne by Warisjeet Singh (sin99xx), credited in NoScript’s changelog.", "date_published": "2026-09-30T03:24:19.881Z", "date_modified": "2026-09-30T03:24:19.881Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)", "url": "https://sin99xx.com/" } ], "tags": [ "vulnerability research", "NoScript" ], "_sources": [ { "name": "NoScript changelog", "url": "https://noscript.net/changelog/" } ] }, { "id": "https://hackicker.com/findings#noscript-sharedworker-identity", "url": "https://hackicker.com/findings#noscript-sharedworker-identity", "title": "Tor Browser / NoScript: SharedWorker identity mismatch", "content_text": "A shared-worker identity mismatch allowed WebAssembly to run at Tor Browser’s Safer security level. Fixed in NoScript 13.6.33 and shipped in Tor Browser 15.0.23. Reported through HackerOne by Warisjeet Singh (sin99xx), credited in NoScript’s changelog.", "date_published": "2026-09-30T03:24:19.881Z", "date_modified": "2026-09-30T03:24:19.881Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)", "url": "https://sin99xx.com/" } ], "tags": [ "vulnerability research", "NoScript", "Tor Browser" ], "_sources": [ { "name": "NoScript changelog", "url": "https://noscript.net/changelog/" }, { "name": "Tor 15.0.23 release", "url": "https://blog.torproject.org/new-release-tor-browser-15023/" }, { "name": "Tor issue #45296", "url": "https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45296" } ] }, { "id": "https://hackicker.com/findings#noscript-html-policy-hook", "url": "https://hackicker.com/findings#noscript-html-policy-hook", "title": "Tor Browser / NoScript: missing HTML policy hook", "content_text": "A missing setHTMLUnsafe hook left child contexts outside WebAssembly restrictions at Tor Browser’s Safer security level. Fixed in NoScript 13.6.33 and shipped in Tor Browser 15.0.23. Reported through HackerOne by Warisjeet Singh (sin99xx), credited in NoScript’s changelog.", "date_published": "2026-09-30T03:24:19.881Z", "date_modified": "2026-09-30T03:24:19.881Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)", "url": "https://sin99xx.com/" } ], "tags": [ "vulnerability research", "NoScript", "Tor Browser" ], "_sources": [ { "name": "NoScript changelog", "url": "https://noscript.net/changelog/" }, { "name": "Tor 15.0.23 release", "url": "https://blog.torproject.org/new-release-tor-browser-15023/" }, { "name": "Tor issue #45297", "url": "https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45297" } ] }, { "id": "https://sin99xx.medium.com/inner-parser-ssrf-e940b76514e7", "url": "https://sin99xx.medium.com/inner-parser-ssrf-e940b76514e7", "title": "Inner-Parser SSRF", "content_text": "The bug class your URL validator was never going to catch.", "date_published": "2026-06-06T00:00:00Z", "date_modified": "2026-06-06T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/race-conditions-are-not-only-race-conditions-e80ab397d93e", "url": "https://sin99xx.medium.com/race-conditions-are-not-only-race-conditions-e80ab397d93e", "title": "Race Conditions Are Not Race Conditions", "content_text": "Concurrency is the cheapest way to wedge a state machine apart. The window is never the bug.", "date_published": "2026-06-04T00:00:00Z", "date_modified": "2026-06-04T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/cve-2026-48840-uninitialised-stack-leak-in-exims-proxy-parser-e2d1336b3e16", "url": "https://sin99xx.medium.com/cve-2026-48840-uninitialised-stack-leak-in-exims-proxy-parser-e2d1336b3e16", "title": "CVE-2026-48840 — Uninitialised Stack Leak in Exim's PROXY Parser", "content_text": "A malformed PROXY frame disclosed live stack bytes before SMTP authentication when the sender was trusted by hosts_proxy.", "date_published": "2026-06-04T00:00:00Z", "date_modified": "2026-06-04T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://github.com/sin99xx/researchlab/blob/main/angular-less-rce.md", "url": "https://github.com/sin99xx/researchlab/blob/main/angular-less-rce.md", "title": "Stylesheets Are Code: Hunting a Build-Time RCE Primitive Hidden in Plain Sight for Four Years", "content_text": "What the supply-chain checkboxes don't check: the stylesheet compiler runs code.", "date_published": "2026-05-03T00:00:00Z", "date_modified": "2026-05-03T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/oidc-and-oauth-2-0-for-people-looking-for-bugs-03b45e2b9aad", "url": "https://sin99xx.medium.com/oidc-and-oauth-2-0-for-people-looking-for-bugs-03b45e2b9aad", "title": "OIDC and OAuth 2.0 for People Looking for Bugs", "content_text": "If a product uses OAuth artifacts to answer OIDC questions, you are already in bug territory.", "date_published": "2026-03-19T00:00:00Z", "date_modified": "2026-03-19T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/cookies-and-cors-for-people-looking-for-bugs-6a67de67784f", "url": "https://sin99xx.medium.com/cookies-and-cors-for-people-looking-for-bugs-6a67de67784f", "title": "Cookies and CORS for People Looking for Bugs", "content_text": "Most teams do not have a cookie model or a CORS model. They have folklore.", "date_published": "2026-03-18T00:00:00Z", "date_modified": "2026-03-18T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/jwts-for-people-who-hunt-bugs-not-blog-posts-3c7020d2d7d8", "url": "https://sin99xx.medium.com/jwts-for-people-who-hunt-bugs-not-blog-posts-3c7020d2d7d8", "title": "JWTs for People Who Hunt Bugs, Not Blog Posts", "content_text": "A serialized cryptographic object carrying attacker-controlled metadata: the question is what the verifier permits.", "date_published": "2026-03-17T00:00:00Z", "date_modified": "2026-03-17T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/when-a-composite-checkout-keeps-pricing-from-a-state-that-no-longer-exists-edffe47cba64", "url": "https://sin99xx.medium.com/when-a-composite-checkout-keeps-pricing-from-a-state-that-no-longer-exists-edffe47cba64", "title": "When a Composite Checkout Keeps Pricing From a State That No Longer Exists", "content_text": "Breaking a transaction invariant in a bundled checkout flow.", "date_published": "2026-03-15T00:00:00Z", "date_modified": "2026-03-15T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/most-bug-bounty-writeups-are-recycled-real-bugs-are-hiding-in-the-specs-ded73f6dd06e", "url": "https://sin99xx.medium.com/most-bug-bounty-writeups-are-recycled-real-bugs-are-hiding-in-the-specs-ded73f6dd06e", "title": "Most Bug Bounty Writeups Are Recycled. Real Bugs Are Hiding in the Specs.", "content_text": "An account takeover through a Google login flow, found by reading the OIDC spec.", "date_published": "2026-03-14T00:00:00Z", "date_modified": "2026-03-14T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/the-header-no-one-was-watching-a-quiet-idor-in-a-financial-system-0fcba65e2ace", "url": "https://sin99xx.medium.com/the-header-no-one-was-watching-a-quiet-idor-in-a-financial-system-0fcba65e2ace", "title": "The Header No One Was Watching", "content_text": "A quiet IDOR in a financial system, found because something felt too clean.", "date_published": "2025-11-19T00:00:00Z", "date_modified": "2025-11-19T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] }, { "id": "https://sin99xx.medium.com/google-gemini-ios-vulnerability-public-link-sharing-silently-leaks-entire-conversations-e1f80cbea25c", "url": "https://sin99xx.medium.com/google-gemini-ios-vulnerability-public-link-sharing-silently-leaks-entire-conversations-e1f80cbea25c", "title": "Google Gemini iOS: Public Link Sharing Silently Leaks Entire Conversations", "content_text": "Share a snippet, leak the conversation. Now CVE-2025-5009.", "date_published": "2025-04-14T00:00:00Z", "date_modified": "2025-04-14T00:00:00Z", "authors": [ { "name": "Warisjeet Singh (sin99xx)" } ] } ] }