Research
Security write-ups.
Five security write-ups covering Android apps, web applications, and smart contracts, plus two essays.
Showing all 07 entries
Published
Jan 31, 2025
When WebView bites back
An exported Android activity loaded attacker-controlled content in a WebView and allowed JavaScript execution.
- Vector
- Exported activity
- Outcome
- JavaScript execution
PublishedDec 30, 2024How a news app leaked OAuth codes
An Android deep-link collision allowed another app to intercept an OAuth authorization code.
- Vector
- Deep-link collision
- Outcome
- Code interception
PublishedNov 26, 2023SQLi: finding and exploitation
How I found a SQL injection, confirmed database access, and reported the issue.
- Vector
- Unsafe input
- Outcome
- Database impact
PublishedMar 13, 2025The function that could mint forever
A missing authorization check allowed a contract role to mint tokens without a supply limit.
- Vector
- Missing authorization
- Outcome
- Unbounded supply
Field guideMar 15, 2023Common smart contract vulnerabilities
Common contract bugs, how they fail, and what to check during a security review.
- Scope
- Failure patterns
- Use
- Defensive review
EssayMar 22, 2025Good vs. bad: truth or bias?
Looking at morality through objective, subjective, and intersubjective frames.
- Question
- Moral judgment
- Frames
- Three perspectives
EssayAug 13, 2026Instagram’s algorithm and the manufacture of doubt
How recommendation feeds can amplify doubt, comparison, jealousy, and surveillance without knowing the truth.
- Question
- Algorithmic influence
- Lens
- Relationships
I publish technical details after disclosure and coordination with the affected organization.