writing
security research, computer-vision systems, and implementation notes from whatever i'm currently poking at.4 published notes
- authorization without a principalan authorized review of a multi-tenant education platform where tenant IDs, unsigned cookies, and unauthenticated service APIs were treated as identity. the result was cross-tenant data exposure, exam-integrity failures, and a potential physical-safety risk.authorizationtenant-isolationidordata-integrityJun 10, 20268 min read1417 words
- corn kernel grading with computer visiona technical writeup on building a computer-vision pipeline for grading corn kernels by damage type, size consistency, and quality thresholds.computer-visionagricultureyoloobject-detectionApr 29, 20264 min read625 words
- the same red-team mistakes keep showing upa short field note on the same broken trust boundaries that keep showing up in real systems: weak reset flows, bad CORS, exposed admin panels, and callback bugs.red-teamobservationssecuritypatternsApr 29, 20266 min read1166 words
- how i could reset anyone's password on a school management platformunauthenticated account takeover on a platform serving international schools. forgot-password endpoint returns the reset token directly in the http response body — four requests, zero prior access, complete staff admin takeover. bonus: open redirect via unvalidated callbackUrl and potential ssrf vector.auth-bypasspassword-resetaccount-takeoverdisclosureApr 18, 20265 min read855 words