Research / Insights

Research & Insights.

Exploring vulnerabilities, breaking down security concepts, and sharing practical lessons from the field.

Bug Bounty WriteupJul 4, 20263 min read

Unsigned API Tokens — Full Account Takeover

How unsigned base64 API tokens with no integrity check led to full account takeover and privilege escalation on a government web application.
Bug Bounty WriteupJun 23, 20263 min read

Supabase RLS Misconfiguration — Full CRUD on Financial Records

How an overly permissive Supabase Row-Level Security policy gave any self-registered user full CRUD access to 20,000+ financial records.
Bug Bounty WriteupMay 29, 20263 min read

Unauthenticated API Credential Disclosure via Public Identifiers

How an unauthenticated endpoint leaked secret API keys by returning full database documents when queried with public identifiers.
Exam WriteupJan 22, 20254 min read

Certified Red Team Analyst [CRTA] Review — Course, Labs, Exam

An honest review of the CRTA certification from Cyberwarfare Labs — course content, hands-on labs, and exam experience.