02 / WRITEUPS

Evidence over noise.

Real-world vulnerability research, practical security guides, and career notes—anonymized where necessary and documented to preserve the thinking behind the result.

01 CASE LIVE / 04 IN REVIEW // ZRX-02
01LIVE CASE STUDY
04INTERNAL EDITIONS
03CONTENT CATEGORIES
01 / FEATURED RESEARCH

The verification boundary failed.

A password-reset flow that trusted a client-visible success state more than server-side proof.

/ 01FEATURED CASE
VECTOR
PASSWORD RESET
IMPACT
AUTH BYPASS
STATUS
TARGET REDACTED
BROKEN ACCESS CONTROLOTPBUG BOUNTY

VULNERABILITY RESEARCH / AUG 17, 2024 / 3 MIN

OTP verification bypass in a crypto trading platform

A redacted case study in response manipulation, weak verification state, and the server-side controls that should protect password recovery.

OPEN CASE FILE ↗
02 / FIELD ARCHIVE

Four more signals.

The remaining field notes are being rewritten and reviewed for their own internal editions.

VULNERABILITY RESEARCH

02 ENTRIES
/ 02IN REVIEW

BUSINESS LOGIC / APR 25, 2025 / 2 MIN

Payment Validation Bypass in a Cloud Storage Platform

A payment-flow validation flaw that provisioned a paid cloud-storage plan without a completed transaction.

PAYMENT LOGICIBANWEB SECURITY
/ 05IN REVIEW

ACCESS CONTROL / JUL 25, 2024 / 2 MIN

Broken Access Control Through Predictable User IDs

A predictable user identifier exposed another account through a missing object-level authorization check.

IDORAUTHORIZATIONWEB SECURITY

SECURITY GUIDES

01 ENTRIES
/ 03IN REVIEW

NETWORK SAFETY / APR 03, 2025 / 3 MIN

Using Public Wi-Fi Safely

A practical introduction to hostile hotspots, traffic interception, VPNs, and safer public-network habits.

PUBLIC WI-FIVPNMITM

CAREER & LEARNING

01 ENTRIES
/ 04IN REVIEW

CAREER GUIDE / APR 08, 2025 / 4 MIN

Choosing an Ethical Hacking Certification

A level-by-level comparison of CEH, Security+, OSCP, eJPT, and PNPT for aspiring security practitioners.

CERTIFICATIONSCAREERLEARNING PATH
DISCLOSURE PROTOCOL // ZRX-DP-01

Authorization before access. Evidence before claims.

Case studies are anonymized where required. Sensitive identifiers, target details, and operational material are withheld when publication could create additional risk.