research

original research. tooling, novel attacks, things i had to figure out the hard way.

2026.06.14 Mantis llm

2026.03.23 Odoo snippet filters: a pre-auth ORM domain you control, evaluated as superuser orm-injection

2026.03.11 Odoo POS self-order: the leak they fixed and the one they didn't info-disclosure

2026.03.09 Odoo Xendit: the payment endpoint that skipped the token check auth-bypass

2023.02.20 Ring 3 Field Notes windows

2022.08.31 Shadow Stack exploit-dev

2022.08.31 Dead SDR Society hardware

2022.08.31 The License Plate Password social-engineering