Vulnerabilities I have found in production systems and responsibly disclosed.
I Could Unlock My Airbnb From Anywhere in the World
The smart lock on my Airbnb had a geofencing feature to prevent remote access. It only worked in CSS.
Security Research
I Hacked My Favorite Sushi Restaurant Using Google Maps
While building my own QR ordering app I decided to test a real production system. A Google Maps photo, some perspective correction, and I had live orders for every table.
How I Got Free Access to MarineTraffic's Paid API as a Student
I found an endpoint that returned paid-tier ship tracking data without checking subscription level. A CS student, a curious HTTP request, and a conversation with their Head of Engineering.