I work with gardens and landscapes. I also hunt bugs.

I work with community gardens and design landscapes for a living. I’m self-taught in security. Here are some of my reports and challenges.

Reports

Findings I submitted to bug bounty and disclosure programs.

Access-management dashboard without a login

I found an access-management dashboard that didn’t require a login. When the first address stopped working, I found another.

Yahoo · Access control

Resolved · Medium

Forgotten search debug flag in production

My first production finding exposed the Acquia/Solr route behind a public search page. The same pattern later gave me three very different experiences with triage.

Mars VDP · Information disclosure / CSV response control

Resolved · Low

Full write-up

Reflected XSS and account profile access

I used reflected XSS to obtain a session token, then read and change my test account’s profile.

Automotive bug bounty · XSS

Duplicate · Medium

Shared conversation import and active content

I reported a shared conversation that imported active content into a signed-in workspace. The program closed it as intended behavior.

AI VRP · Trust boundary

Won't fix · S3 (P4)

Base64 URL parameter to HTML/CSS injection

I traced a Base64-encoded payload in a URL parameter through to full HTML/CSS injection. The injected content could trigger outbound requests to arbitrary external endpoints. The report passed program review and was accepted at low severity.

Private program · HTML/CSS injection

Accepted · Low

Login and password-reset rate limits bypassed through identity rotation

I used Tor and Burp to test a web app’s authentication limits. Changing Tor identity gave me roughly 15 more password attempts against the same account and let me send additional password-reset emails.

Redacted target · Authentication / rate limiting

Duplicate

Research notes

Other investigations and unfinished attempts.

Live credentials in public Git history

I automated scans of public AI repositories and their Git history with TruffleHog. The scans found dozens of valid keys.

Automated research · Credential exposure

Informative · N/A

Practice and write-ups

CTF and Dojo challenges. Write-ups are linked when available.

Highscore: character counting to query bypass

I used a UTF-8 byte-count mismatch to smuggle JSON syntax past a filter and replace the ORM query.

YesWeHack Dojo #54 · Report #2123-5752 · JSON injection / query bypass

Resolved · Medium (5.3)

Full write-up

Base64-wrapped SQL injection

I followed a Base64-decoded gallery parameter into a MySQL query, enumerated the challenge database, and retrieved the flag.

Intigriti September Challenge · SQL injection

Resolved · Medium

Full write-up

CSRF in vault sharing

I used a cross-site request to make the challenge administrator share their private vault.

Intigriti LeakyJar · CSRF

Resolved · Medium

Full write-up

Email parsing and ERB template injection

The validator and email parser read the same address differently. I used that mismatch to reach an ERB template injection.

YesWeHack Dojo #53 · Report #2123-5018 · Code injection

Resolved · High (7.5)

Full write-up

JWT forgery and local file read

I used a known README file to sign an admin JWT, then read the challenge flag through an M3U8 playlist.

YesWeHack Dojo #52 · Report #2123-4782 · Path traversal / local file inclusion

Resolved · Medium (5.3)

Full write-up

Yahoo · Resolved · Medium

Access-management dashboard without a login

What I found
I found an internal access-management dashboard while checking subdomains and IP addresses. It was accessible without a login.
What I tried
The original address was blocked before triage could reproduce the finding. I kept looking, found the same dashboard at a second address, and sent updated evidence.
Result
Yahoo triaged the report as medium, resolved it, and awarded a four-figure bounty plus a bonus.

Mars VDP · Resolved · Low

Forgotten search debug flag in production

What I found
A public search page accepted debug=1 and printed its backend Acquia/Solr host, collection path, and connection trace. On some sites, that route also exposed schema field names through a CSV response.
What I tried
I tested a formula / DDE-shaped value. The direct company-hosted URL opened as CSV in Excel in my test and immediately showed a trust prompt; it did not execute silently. I also confirmed a limited predictable collection pattern, then stopped.
Result
Mars resolved the finding as low severity. Nestlé closed the related reports as out of scope. I understand the social-engineering concern, but the endpoint still generated attacker-controlled spreadsheet content from the company’s own infrastructure. DOJ described the disclosure as low impact and outside its policy.

Automotive bug bounty · XSS · Duplicate · Medium

Reflected XSS and account profile access

What I found
Redacted.
What I tried
Redacted.
Result
The report was closed as a duplicate. I’ve left out the target name and identifying endpoints.

Redacted target · Duplicate

Login and password-reset rate limits bypassed through identity rotation

What I found
The login limit did not hold across Tor identity changes. Each new identity allowed roughly 15 additional password attempts against the same account. I observed the same bypass on password-reset emails, with no account-level lockout during testing.
What I did
I reached the login limit, changed Tor identity, and repeated the test against the same account while inspecting requests in Burp. The requests carried different device and anti-abuse tokens after each change. I also checked the reset flow and confirmed that registration and password changes accepted simple 10-character numeric passwords.
Impact
The bypass allowed repeated password guessing against one account and repeated reset emails beyond the intended limit. Account takeover was a potential consequence if a password was guessed and no further authentication control prevented access; it was not demonstrated in this report.
Result
The report was closed as a duplicate. Target and request identifiers are redacted.

Automated research · Informative · N/A

Live credentials in public Git history

What I found
I found valid credentials in the Git history of public AI repositories, despite the platform’s secret-scanning controls.
What I tried
I automated the scans with TruffleHog and checked several types of credentials. The results included dozens of valid keys, some associated with researchers at largest technology companies and Elite Universities.
Result
Some keys were revoked. Most reports were outside the available bounty scopes or received no further response.

I’ve left out organization names, repositories, credentials, and reproduction details.

AI VRP · Won't fix · S3 (P4)

Shared conversation import and active content

What I found
A shared conversation could be imported into a signed-in workspace without prior confirmation or clear attribution. It could then render active SVG and iframe content.
What I tried
I tested whether the content ran again when the conversation reopened, control of the iframe content, and misleading attribution in picture-in-picture windows. I also documented persistence concerns for managed accounts with restricted history deletion.
Result
After almost four months of follow-ups and a reassessment request, the program closed the report as intended behavior. It did not consider the demonstrated harm sufficient.

I’ve left out the product name, endpoint, proof of concept, and reproduction details.

Intigriti LeakyJar · Resolved · Medium

CSRF in vault sharing

What I found
The session cookie used SameSite=None. The vault-sharing action had no CSRF token.
What I tried
I sent a sharing request from an external page. The browser included the administrator’s session cookie, and the request shared their vault with my challenge account.
Result
The challenge report was accepted as medium severity and later archived as resolved.
Read the full LeakyJar write-up

YesWeHack Dojo #54 · Report #2123-5752 · Resolved · Medium (5.3)

Highscore: character counting to query bypass

What I found
The filter counted JavaScript string characters but inspected bytes from a UTF-8 buffer. Multi-byte characters made those two positions drift apart.
What I tried
I used multi-byte padding to keep injected JSON syntax beyond the bytes examined by the filter. A duplicate key then replaced the object passed into the ORM query.
Result
The query returned the privileged challenge record. The report was resolved at Medium (5.3).
Read the full Highscore write-up

Intigriti September Challenge · Resolved · Medium

Base64-wrapped SQL injection

What I found
The pic parameter was decoded from Base64 and inserted into a MySQL query without parameterization.
What I tried
I confirmed the injection, identified MySQL, enumerated the challenge schema, and read the note stored in the secret table.
Result
The challenge report was closed as resolved at medium severity.
Read the full September Challenge write-up

YesWeHack Dojo #53 · Report #2123-5018 · Code injection · Resolved · High (7.5)

Email parsing and ERB template injection

What I found
The regular-expression validator and the email parser interpreted the same address differently.
What I tried
I used that difference to get past validation. The invitation renderer then evaluated the display name I supplied as ERB template code.
Result
The report was resolved at High (7.5). The full solution is in the write-up.
Read the full Dojo write-up

YesWeHack Dojo #52 · Report #2123-4782 · Path traversal / local file inclusion · Resolved · Medium (5.3)

JWT forgery and local file read

What I found
The JWT’s unverified kid field selected the signing-key file. The M3U8 playlist also accepted local files as media segments.
What I tried
I used path traversal to select a README with known contents as the HMAC key. I signed an admin token with it and submitted a playlist pointing to the challenge flag.
Result
I retrieved the flag and documented the full solution. The report was resolved at Medium (5.3).
Read the full Dojo write-up