PUBLIC SECURITY RESEARCH
Disclosures, primary references, and tools for understanding how systems break.
Missing caller authorization, unverified worker-result authority and unconstrained storage abstraction crossed service boundaries. The researcher questioned whether a narrowly named field actually limited…
Read the caseGitHub confirms production-container credential exposure and assessed with high confidence that the issue had not been previously exploited and impact was…
Potential takeover of third-party application accounts using the integration without additional safeguards. Named third-party applications were not tested…
The researcher observed code execution across multiple service contexts. The disclosed account does not establish a broader compromise beyond those…
Researcher reports a separate, lower-severity account-takeover finding, fixed before publication.
The researcher demonstrated credential exposure and modeled the remaining path to repository control without executing the final supply-chain…
The author reports third-party account access, elevated permissions and mailbox access. Reduced-interaction behavior required a signed-in user opening a…
The two branch-specific patches require control-panel request context, a valid form and integration permission, then limit mutable settings while…
maintainer advisoryThe announced fix narrows accepted client input and checks server responses. Update dependencies and the lockfile, verify resolved…
maintainer advisoryDefine output-safety invariants for every observable intermediate state, not just the completed answer. Keep generated content inert until applicable…
research paperTreat every request-to-server-API adapter as an authority boundary. Explicitly preserve the requesting actor and require the relevant collection…
maintainer advisory40 reviewed policies · 808 captured scopes · source links & coverage status
| / | Focus search on this page |
| Ctrl K | Search everything (command palette) |
| 1-9 | Library, Generator, Playbooks, Gadgets, Checklists, Payloads, Bypasses, Utilities, Reports |
| 0 | AI / MCP connector |
| j / k | Move selection down / up |
| Enter | Expand / open selected |
| c | Copy primary command of selected |
| f | Toggle favorite on selected tool |
| Esc | Clear search / close |