blog
xAI was serialising the GrowthBook decryption key into the React Server Components payload. Anyone could decrypt the feature flag config and read which enterprise customers were enrolled in which experiments.
Goldman's frontend bundle shipped with a server-side config object containing internal service names, pipeline markers, and unreleased feature flag names. No credentials. All raw material for the next step of a chain.
OPPO Cloud's transport encryption was using a key size broken since 1999. We factored it for $5 in cloud compute. Every production endpoint accepted forged requests.
An authentication vulnerability in Anduril's Lattice platform affected over 60 instances across production, development, and military environments.
DoorDash's API returned different error messages for existing vs non-existing records with no rate limiting, enabling full order ID enumeration.
Best Buy's employee authentication system was publicly accessible, leaking 47 internal service names and helpdesk contact details.
A Department of Defense website for the Non-Lethal Weapons Program accepted cross-origin requests from any domain with credentials.
Methodology & Guides
Prompt injection grew 540% in twelve months. Why the real risk is not chatbots, but tool-using agents that read attacker-controlled content. Four things to audit in every production LLM app.
The same six classes of JWT failure show up in every stack: weak HS256 secrets, algorithm confusion, kid injection, missing expiration, the none algorithm, and unaudited claims.
UUIDs and modern frameworks did not kill IDOR. They moved it. Export endpoints, GraphQL nested fields, predictable UUIDv1 tokens, and batch endpoints are where the new criticals hide.
How production JS bundles leak staging hostnames, API keys, feature flag configs, and internal service names. With real examples from CLEAR and Exness.
What automated scanners are good at vs what they miss. Business logic, auth bypass, chained attacks, and crypto weaknesses all require manual testing.
The concept of vulnerability chaining. How information disclosure, SSRF, and cloud misconfiguration combine into full data access.
Introspection, no depth limits, batching without rate limits, verbose errors, and missing field-level authorization. With a real DoorDash example.
Top 2.5% in 90 days. $18k in bounties. Goldman Sachs, DoorDash, Anduril, OPPO, and the DoD. What worked, what didn't.