Security Research

The same check-then-act race keeps appearing across services: purchase-limit bypass, one draw used by many requests, duplicate coupon cancellation, daily-reward overruns. I built a real stack (nginx + Tomcat×2 + shared Postgres + Redis) and measured which fix actually holds. Most of them need no Redis lock — just a DB conditional UPDATE and an affected-rows check.

Algorithm names like AES-256 or TLS reveal nothing about how keys are generated, who controls the endpoint, or whether a response binds to the real transaction. A broader, evidence-based assessment model for external SDKs and native binaries.

A malicious server corrupting a client that dials out to it, carrying both the libc leak and the second stage over one already-open socket in a single ROP chain. And why this is not a new pattern but a well-known composition.

Bringing world-class hackers and a CTF research ecosystem into an organization can make it stronger, but real security improvement requires turning offensive capability into governance and structural change.

A practical method for modeling vulnerabilities as attacker-relevant security state transitions and combining human intuition with bounded AI search

In practical cryptography, failures often occur in the design—combining randomness, key management, operating modes, error handling, and authentication—rather than in the algorithms themselves. This post outlines criteria for auditing cryptographic implementations from the perspective of security assessors and reversers.

This article explains how I split an XSS security development specification for small local models into core/verify/dev/test overlays, and what I learned while connecting LLM-based judgment to regression-test generation and Jazzer/Jazzer.js fuzzing seeds.

I designed sec-audit-static workflow v2.0, ran it against a real auth-server codebase, and missed two things. This is the record of how those misses were folded back into the tool — through v2.8.

Security controls already exist. The real problem is that we cannot decide which customer, at which moment, deserves how much friction. As the closing chapter of the CAPTCHA·ATO series, this post is about moving from quantity of controls to context of controls — adaptive security as an operational discipline.

A practical account of applying dataflow-based clustering to a real codebase — reducing 228 endpoints to 5 reviewable clusters, and finding an RCE chain in the cross-section.