Writing
Blog Posts
Notes on software, systems, research, and the occasional tangent.
2026
-
Discovered a critical broken access control vulnerability in bdf.belgium.be that exposed sensitive user information including emails and phone numbers of mil...
2025
-
Learn how to identify and perform a takeover of unclaimed Framer subdomains, such as *.framer.website, to demonstrate a security vulnerability.
2024
-
A journey from basic subdomain enumeration to discovering a critical GraphQL denial-of-service vulnerability. What started as routine reconnaissance with sub...
-
A self-XSS in an AI support chat led me to test document.domain, which unexpectedly revealed an S3 bucket. This discovery exposed 12.000+ customer conversati...