Collection / 02

The reading room.

Eleven published articles on parsers, protocols, and the assumptions in between.

NoScript / Tor Browser findings →Research + writing RSS ↗

2026-06-06
Inner-Parser SSRF
The bug class your URL validator was never going to catch.

Protocols · Medium ↗ · researchlab ↗
2026-06-04
Race Conditions Are Not Race Conditions
Concurrency is the cheapest way to wedge a state machine apart. The window is never the bug.

Concurrency · Medium ↗ · researchlab ↗
2026-06-04
CVE-2026-48840 — Uninitialised Stack Leak in Exim's PROXY Parser
A malformed PROXY frame disclosed live stack bytes before SMTP authentication when the sender was trusted by hosts_proxy.

Protocols · Medium ↗ · researchlab ↗
2026-05-03
Stylesheets Are Code: Hunting a Build-Time RCE Primitive Hidden in Plain Sight for Four Years
What the supply-chain checkboxes don't check: the stylesheet compiler runs code.

Code execution · researchlab ↗
2026-03-19
OIDC and OAuth 2.0 for People Looking for Bugs
If a product uses OAuth artifacts to answer OIDC questions, you are already in bug territory.

Protocols · Medium ↗
2026-03-18
Cookies and CORS for People Looking for Bugs
Most teams do not have a cookie model or a CORS model. They have folklore.

Protocols · Medium ↗
2026-03-17
JWTs for People Who Hunt Bugs, Not Blog Posts
A serialized cryptographic object carrying attacker-controlled metadata: the question is what the verifier permits.

Protocols · Medium ↗
2026-03-15
When a Composite Checkout Keeps Pricing From a State That No Longer Exists
Breaking a transaction invariant in a bundled checkout flow.

State logic · Medium ↗ · researchlab ↗
2026-03-14
Most Bug Bounty Writeups Are Recycled. Real Bugs Are Hiding in the Specs.
An account takeover through a Google login flow, found by reading the OIDC spec.

Identity · Medium ↗ · researchlab ↗
2025-11-19
The Header No One Was Watching
A quiet IDOR in a financial system, found because something felt too clean.

Access control · Medium ↗
2025-04-14
Google Gemini iOS: Public Link Sharing Silently Leaks Entire Conversations
Share a snippet, leak the conversation. Now CVE-2025-5009.

Product security · Medium ↗

Newest first. Mirrored pieces appear once. Read researchlab ↗