▊ Research

Research notes.

Public-facing notes on techniques, patterns and workflow, written by the team that runs the engagements. Depth first, marketing never.

Jul 2025

Understanding duplicate query parameter parsing

A short study of framework behavior when the same query parameter is provided twice, with implications for authorization, cache keys, and rate limiting.

ParsingHTTP

Read →

Jul 2025

Origin bottlenecks behind CDN deployments

Where origin protection actually breaks down when the edge is trusted implicitly, and how to model realistic reachability from an attacker viewpoint.

InfrastructureEdge

Read →

Jun 2025

Cloudflare origin protection checklist

A working checklist we use across engagements to reason about origin exposure, from CT-log audit to firewall trust anchoring.

CloudflareOrigin

Read →

Jun 2025

API abuse patterns

Common patterns in real-world API abuse we consistently see. Beyond OWASP categories, closer to how APIs are actually used and misused in production.

APIAbuse

Read →

May 2025

Responsible disclosure workflow

How we run disclosure end to end, from private report to final validation, with the artifacts and communication expected at each step.

Process

Read →

May 2025

Authentication edge cases

A survey of authentication edge cases that consistently surface in engagements: session pinning, mixed-scope tokens, and cross-domain assumptions.

Auth

Read →

Apr 2025

GraphQL enumeration techniques

Practical GraphQL enumeration and cost analysis: schema introspection under partial restrictions, field-level access control, and query cost modeling.

GraphQLAPI

Read →

Apr 2025

TRPC security observations

Observations from TRPC-based systems in production, where the client-server contract quietly becomes an implicit trust boundary.

TRPCAPI

Read →