Security research
Security research without exposing the target.
Some work can be described through vulnerability class and severity; other work is safer to publish through methodology and evidence boundaries. This page does both while withholding details that would identify private research targets or turn a portfolio entry into an operational guide.
Security research
Critical findings, disclosure-safe.
I identified multiple previously undisclosed critical vulnerabilities rated CVSS 9.8, including SQL injection and unauthenticated remote code execution.
Each finding was confirmed through controlled proof-of-concept testing and accompanied by technical evidence and remediation guidance for coordinated disclosure.
Disclosure boundary: Coordinated disclosure is still open. The vendor, product, product category, application type, affected environment, employer or customer context, and implementation details are intentionally withheld.
Earlier and authorized research
Work that can be described openly: completed disclosures, assessments of systems I own or operate, and analysis performed under explicit authorization. It is kept separate from the open disclosure above.
-
Own-vehicle embedded research
Reverse-engineered the media control unit of my own Tesla to obtain root access, then studied the embedded environment and application behaviour from the inside. Authorized by ownership.
-
Learning-platform authorization flaw
Found and disclosed an authorization vulnerability in an online learning platform that exposed administrative access. Reported to the operator; the platform is not named here.
-
Compromised game-cache implant
Compared 6,248 client scripts across original and modified releases to isolate an obfuscated chat-handler prologue, reconstruct its runtime-built strings and substitution cipher, and trace a command channel capable of clipboard exfiltration, with a reproducible network-isolated analysis workflow.
-
Owner-authorized attack-surface assessment
Zero-impact external assessment of a multi-service production presence I operate: passive reconnaissance, non-intrusive testing, ranked remediation, and two initial findings disproved by re-testing from public vantage points.
-
Fleet vulnerability audit
Phased audit of an 86-host lab fleet with version-based CVE assessment, evidence-based false-positive rejection, and a gentler profile with post-scan health checks for fragile hosts.
-
Hypervisor isolation analysis
Read-only analysis of a three-host virtualization cluster across workload, management, vMotion, and storage planes, validating layer-2 protections and identifying patch-level exposure to guest-to-host escape classes.
Reverse engineering
Windows kernel-driver static analysis
I also published a sanitized case study from a larger kernel-driver reverse-engineering investigation. It focuses on the engineering work that can be shared responsibly: PE structure and entropy analysis, imports and exports, strings, embedded PE-image identification, targeted Capstone disassembly, static references, Python-based repeatability, hardened sample handling, and explicit limits on what static evidence can prove.
The vendor, product, game, research objective, target-specific architecture and findings, offsets, signatures, interface mappings, and mitigation or bypass implications remain private.