Engagement Timeline

A public-facing subscription feature on a large consumer health media platform disclosed an internal account identifier that other parts of the platform trusted as proof of identity. Chained together, this allowed an unauthenticated party to enumerate accounts by email and modify account state without a session. Reproduced and confirmed by the program's triage team; closed as an accepted business risk with no remediation observed.

A self-initiated responsible disclosure engagement against a national-level political party management platform, uncovering unauthenticated password tampering, sensitive-data IDOR exposure, and session-lifecycle weaknesses.

A self-initiated responsible disclosure engagement uncovering unauthenticated account takeover (including admin accounts), two independent SQL injection vulnerabilities, and exposure of live third-party credentials across two separate customer databases.

Self-initiated responsible disclosure uncovering critical authentication bypass enabling full account takeover, alongside systemic broken access control exposing applicant PII across multiple endpoints. Findings acknowledged within 72 hours.

Authorized security assessment of an e-commerce platform's bug bounty program focusing on authentication services, API gateways and supporting microservices. Identified confirmed High severity CORS misconfiguration alongside multiple defense-in-depth weaknesses.

Identified unauthenticated cross-user basket read vulnerability via GraphQL IDOR. Basket UUIDs assigned pre-authentication allowed any actor to read another user's basket contents with zero credentials. Confirmed valid by program; closed as duplicate.

Independent application security assessment of a public sector digital platform. The engagement demonstrated how individually low-risk information disclosures can collectively improve attacker reconnaissance and reduce the effort required to understand an organization's authentication architecture. The findings reinforced the value of defense-in-depth and careful management of implementation details exposed to external users.

Identified a stored Cross-Site Scripting vulnerability in the vehicle inquiry submission workflow that resulted in JavaScript execution inside the dealer CRM through blind XSS callbacks.