02Writingthe log — 11 pieces

Research, in the open.

Newest first. Long reads live on Medium; raw markdown in the researchlab repo. Mirrored pieces are listed once.

2026-06-06 Inner-Parser SSRF The bug class your URL validator was never going to catch. Medium · researchlab
2026-06-04 Race Conditions Are Not Race Conditions Concurrency is the cheapest way to wedge a state machine apart. The window is never the bug. Medium · researchlab
2026-06-04 CVE-2026-48840 — Uninitialised Stack Leak in Exim's PROXY Parser Half the mail servers on the internet, reachable before auth. Medium · researchlab
2026-05-03 Stylesheets Are Code: Hunting a Build-Time RCE Primitive Hidden in Plain Sight for Four Years What the supply-chain checkboxes don't check — the stylesheet compiler runs code. researchlab
2026-03-19 OIDC and OAuth 2.0 for People Looking for Bugs If a product uses OAuth artifacts to answer OIDC questions, you are already in bug territory. Medium
2026-03-18 Cookies and CORS for People Looking for Bugs Most teams do not have a cookie model or a CORS model. They have folklore. Medium
2026-03-17 JWTs for People Who Hunt Bugs, Not Blog Posts A serialized cryptographic object carrying attacker-controlled metadata — the question is what the verifier permits. Medium
2026-03-15 When a Composite Checkout Keeps Pricing From a State That No Longer Exists Breaking a transaction invariant in a bundled checkout flow. Medium · researchlab
2026-03-14 Most Bug Bounty Writeups Are Recycled. Real Bugs Are Hiding in the Specs. An account takeover through a Google login flow, found by reading the OIDC spec. Medium · researchlab
2025-11-19 The Header No One Was Watching A quiet IDOR in a financial system — found because something felt too clean. Medium
2025-04-14 Google Gemini iOS: Public Link Sharing Silently Leaks Entire Conversations Share a snippet, leak the conversation. Now CVE-2025-5009. Medium