Hackicker — writing Research notes and verified-finding breakdowns. Newest first. https://hackicker.com/ 2026-09-02T00:00:00Z Inner-Parser SSRF https://sin99xx.medium.com/inner-parser-ssrf-e940b76514e7 2026-06-06T00:00:00Z 2026-06-06T00:00:00Z The bug class your URL validator was never going to catch. Warisjeet Singh (sin99xx) Race Conditions Are Not Race Conditions https://sin99xx.medium.com/race-conditions-are-not-only-race-conditions-e80ab397d93e 2026-06-04T00:00:00Z 2026-06-04T00:00:00Z Concurrency is the cheapest way to wedge a state machine apart. The window is never the bug. Warisjeet Singh (sin99xx) CVE-2026-48840 — Uninitialised Stack Leak in Exim's PROXY Parser https://sin99xx.medium.com/cve-2026-48840-uninitialised-stack-leak-in-exims-proxy-parser-e2d1336b3e16 2026-06-04T00:00:00Z 2026-06-04T00:00:00Z Half the mail servers on the internet, reachable before auth. Warisjeet Singh (sin99xx) Stylesheets Are Code: Hunting a Build-Time RCE Primitive Hidden in Plain Sight for Four Years https://github.com/sin99xx/researchlab/blob/main/angular-less-rce.md 2026-05-03T00:00:00Z 2026-05-03T00:00:00Z What the supply-chain checkboxes don't check — the stylesheet compiler runs code. Warisjeet Singh (sin99xx) OIDC and OAuth 2.0 for People Looking for Bugs https://sin99xx.medium.com/oidc-and-oauth-2-0-for-people-looking-for-bugs-03b45e2b9aad 2026-03-19T00:00:00Z 2026-03-19T00:00:00Z If a product uses OAuth artifacts to answer OIDC questions, you are already in bug territory. Warisjeet Singh (sin99xx) Cookies and CORS for People Looking for Bugs https://sin99xx.medium.com/cookies-and-cors-for-people-looking-for-bugs-6a67de67784f 2026-03-18T00:00:00Z 2026-03-18T00:00:00Z Most teams do not have a cookie model or a CORS model. They have folklore. Warisjeet Singh (sin99xx) JWTs for People Who Hunt Bugs, Not Blog Posts https://sin99xx.medium.com/jwts-for-people-who-hunt-bugs-not-blog-posts-3c7020d2d7d8 2026-03-17T00:00:00Z 2026-03-17T00:00:00Z A serialized cryptographic object carrying attacker-controlled metadata — the question is what the verifier permits. Warisjeet Singh (sin99xx) When a Composite Checkout Keeps Pricing From a State That No Longer Exists https://sin99xx.medium.com/when-a-composite-checkout-keeps-pricing-from-a-state-that-no-longer-exists-edffe47cba64 2026-03-15T00:00:00Z 2026-03-15T00:00:00Z Breaking a transaction invariant in a bundled checkout flow. Warisjeet Singh (sin99xx) Most Bug Bounty Writeups Are Recycled. Real Bugs Are Hiding in the Specs. https://sin99xx.medium.com/most-bug-bounty-writeups-are-recycled-real-bugs-are-hiding-in-the-specs-ded73f6dd06e 2026-03-14T00:00:00Z 2026-03-14T00:00:00Z An account takeover through a Google login flow, found by reading the OIDC spec. Warisjeet Singh (sin99xx) The Header No One Was Watching https://sin99xx.medium.com/the-header-no-one-was-watching-a-quiet-idor-in-a-financial-system-0fcba65e2ace 2025-11-19T00:00:00Z 2025-11-19T00:00:00Z A quiet IDOR in a financial system — found because something felt too clean. Warisjeet Singh (sin99xx) Google Gemini iOS: Public Link Sharing Silently Leaks Entire Conversations https://sin99xx.medium.com/google-gemini-ios-vulnerability-public-link-sharing-silently-leaks-entire-conversations-e1f80cbea25c 2025-04-14T00:00:00Z 2025-04-14T00:00:00Z Share a snippet, leak the conversation. Now CVE-2025-5009. Warisjeet Singh (sin99xx)