Notes from the work.
Short write-ups of findings, fixes and the occasional thing I broke on purpose. The same notes go out on LinkedIn and GitHub, then land here so they stay findable.
3 posts
RSSThe retest is the report
A finding is a claim. The retest is the proof. Why most engagements stop one step too early, and what changes when they don't.
What I check before I check for vulnerabilities
Scope, ownership and reachability decide more about an engagement's outcome than any payload. A short note on the hour I spend before testing starts.
Gerobug v2.7: two findings, two CAN requests
Notes from auditing an open-source bug bounty platform, confirming two issues with live proof, and taking them through disclosure.
Prefer it in your feed?
New notes go to LinkedIn and GitHub first. If you would rather not rely on an algorithm to show them to you, the RSS feed does the job.
Typically replies within one business day. NDA on request.
hello@enesismaili.com