Research
Research
Two kinds of pieces, one feed: writeups — technical deep-dives on the bugs I find — and articles — essays on Rust, tooling, and methodology. Each card is tagged so you know which is which.
Approving a crypto licence on any Google Ads account
The Ads identity agent answered with no cookies and took the customer id out of the request body. Two curl calls, and the account shows an approved restricted certification it never qualified for.
The five ways DeFi protocols get drained
Most post-mortems describe the same five failure families: access control, accounting drift, oracle failure, liquidation assumptions and integrations. Here is what each one looks like in code.
Enterprise-grade, from scratch
1.8 million lines of Rust, one binary, a self-hosted OOB server, and an AI that writes its own exploits. Almost a year building Hugin to a high bar.
This is the endgame for Anthropic
Anthropic watermarks your Claude Code system prompt based on your timezone and proxy settings. I verified it in my own binary, v2.1.190.
Open source is the exit
The US can switch off a frontier model overnight; China gives away models just as good. The closed-AI giants are in deeper trouble than they admit.
JavaScript is the past
JavaScript won the browser, but the next edge in security tooling is closer to the machine: native binaries, memory-safe systems code, and tools that keep up.
Read the scope first
Most of the time I lose on a target is lost to my own setup and assumptions, not the target. A short note on the discipline that actually moves findings.
Why I built Hugin
Every engine in Hugin is mine, written from scratch in Rust. The honest version of why it exists.