security research, mostly on open source. i read code more than i run tools.
what i look at
wordpress plugins, npm and pip packages, self hosted apps. the parts nobody photographs: archive extraction, import features, access control on the endpoint nobody remembers exists.
stack
python · php · javascript · go
wordpress internals · node and npm ecosystem · docker-based reproduction · static analysis
how i work
reproduce locally first. report privately. publish after the fix ships. minimum proof, no real user data.
currently
- a local stack for pulling apart wordpress plugins
- a growing pile of npm and pip packages that unpack archives
- first report is out, waiting on triage
elsewhere