Security Research

How renting Apple Developer account capacity to sideload apps became a lucrative business in China, and how vendors automate Apple’s own signing infrastructure.

The smart lock on my Airbnb had a geofencing feature to prevent remote access. It only worked in CSS.

While building my own QR ordering app I decided to test a real production system. A Google Maps photo, some perspective correction, and I had live orders for every table.

I found an endpoint that returned paid-tier ship tracking data without checking subscription level. A CS student, a curious HTTP request, and a conversation with their Head of Engineering.