How Deleting My Own Video Gave Me Code Execution on a Production Server
13 min read
A webhook template, one missing semicolon, and an ordinary media deletion chained into remote code execution as the production web-server user.
/ posts
The Forgotten Grant: How a Legacy OAuth Flow in an Android SDK Bypassed 2FA
12 min read
I want to walk through this finding the way it actually happened, not the cleaned-up, textbook version — because in bug bounty, the dead ends, false assumptions, and debugging rabbit holes matter…
Anthropic Leaked Their Own Source Code and the Internet Lost Its Mind
12 min read
March 31, 2026. One day before April Fools. Anthropic - the $380 billion “safety-first” AI lab - accidentally shipped the complete source code of Claude Code to the public npm registry.
Email-Based User Enumeration
3 min read
This Blog is related to privacy-related vulnerability that I reported to a private bug bounty program.