Security research & responsible disclosure

A document-retrieval path in the Commission's Electronic Document Management System served corporate records without verifying that the requester was entitled to them. Because document identifiers were sequential and no authorisation check stood in front of the response, the exposure was not limited to a single record. It was systemic.

I reported it alongside remediation guidance: authentication middleware on document routes, document-level access control lists, rate limiting, audit logging, and a wider review of the platform's session management.

A critical flaw on the university's platform placed student data privacy at risk. Rather than probe further, I escalated it immediately and contacted the university's Chief Technology Officer to establish a secure disclosure channel before any detail changed hands.

A textbook coordinated disclosure: a named owner, a private channel, a fast acknowledgement, and a reward. Exactly the process every organisation should be able to run.

An account lookup on the BillPoint payment platform returned a user's full profile to anyone who supplied their email address. There was no check that the requester owned the account being looked up, so a single known email address was enough to read that customer's contact details and financial position. Since an email address is not a secret, every registered account was effectively queryable by anyone who knew, or guessed, the address attached to it.

This is the flaw class people underestimate most. No exploit chain, no clever payload, just an endpoint that answered a question it should have refused to answer. On a fintech product it is also the most costly, because the data it hands over is exactly what a fraudster needs to sound legitimate.