Security Research, Published In Full.

Vulnerabilities we found in real systems, written up the way we write findings for clients. Only work that has been fully disclosed appears here.

Latest

Remote Code ExecutionMATLAB Online (MathWorks)Oct 20269 min read

Remote Code Execution in MATLAB Online AI Chat Playground via the `system()` Function

This writeup documents a Remote Code Execution (RCE) vulnerability identified during independent bug bounty research against MathWorks' MATLAB Online AI Chat Playground. The in-browser playground is designed to execute user-supplied MATLAB code, but MATLAB's built-in `system()` function passed its argument directly to the underlying operating-system shell. By invoking `system()` with a shell command, an authenticated user could execute arbitrary OS-level commands on the backend host, break out of the intended MATLAB-only execution boundary, establish an interactive reverse shell, and read arbitrary files. The affected service runs on a shared, multi-tenant compute pool. The vulnerability was reported through the bug bounty program and publicly disclosed. This research highlights the importance of strict command isolation, egress filtering, and defense-in-depth for hosted code-execution environments.

Read the writeup by Manish Singh

More Web2 research

Fully disclosed only

Cross-Site Request Forgery (CSRF)OpenAI Discord VerificationOct 20268 min read
One Link to Unlink: CSRF in OpenAI's Discord Verification Service
A CSRF vulnerability in OpenAI's Discord verification service allowed the account-unlinking operation to be triggered through a state-changing GET request without adequate anti-CSRF protection. The issue was reported through Bugcrowd and marked P3, resolved and fixed, in the published research.
Insecure Direct Object Reference (IDOR) / BOLACoinDepoOct 20267 min read
IDOR on CoinDepo: Unauthorized Access to User KYC Records
This writeup documents an Insecure Direct Object Reference (IDOR) vulnerability identified during independent bug bounty research against CoinDepo. The issue allowed an authenticated user to retrieve another account's Know Your Customer (KYC) information by manipulating identifier fields in a profile API request. The finding demonstrated a broken object-level authorization control affecting sensitive personal information, including identity details and references to uploaded identification documents. The vulnerability was reported through HackenProof and publicly disclosed. This research highlights the importance of enforcing server-side authorization checks and deriving account ownership from the authenticated session rather than trusting client-controlled request parameters.
Remote Code Execution · UnauthenticatedIndependent researchSept 20263 min read
Unauthenticated Remote Code Execution in Langflow via Code Validation
An unauthenticated remote code execution vulnerability was identified in Langflow's /api/v1/validate/code endpoint, where attacker-controlled Python code could be executed on the underlying server during code validation. Tracked as CVE-2025-3248, the vulnerability can allow an unauthenticated remote user to execute operating-system commands with the privileges of the Langflow process.

Want this standard applied to your product?

A 30 minute scoping call, then a fixed price. No discovery questionnaire, no pressure to buy.

Book a scoping call

Email instead

One Link to Unlink: CSRF in OpenAI's Discord Verification Service

IDOR on CoinDepo: Unauthorized Access to User KYC Records

Unauthenticated Remote Code Execution in Langflow via Code Validation

Want this standard applied to your product?