Cybersecurity research & responsible disclosure

A document-retrieval path in the Commission's Electronic Document Management System served corporate records without verifying that the requester was entitled to them. Because document identifiers were sequential and no authorisation check stood in front of the response, the exposure was not limited to a single record. It was systemic.

I reported it alongside remediation guidance: authentication middleware on document routes, document-level access control lists, rate limiting, audit logging, and a wider review of the platform's session management.

A broken access control flaw on the university's learning platform exposed personal data belonging to other students. I stopped testing once I had enough evidence to prove it, then contacted the university's Chief Technology Officer to set up a private channel before sharing any detail.

The university had a named owner for the report, acknowledged it the same day and paid a bounty twelve days later.

I found this while using BillPoint as a customer. An account lookup on the platform returned a user's full profile to anyone who supplied their email address. There was no check that the requester owned the account being looked up, so a single known email address was enough to read that customer's contact details and financial position. Since an email address is not a secret, every registered account was effectively queryable by anyone who knew, or guessed, the address attached to it.

No exploit chain was needed, just an endpoint that returned data without checking who asked. On a payments product that data is exactly what a fraudster needs to sound legitimate.