home / findings
Findings
Vulnerability research, published only after the issue is fixed. Each entry links to a full report.
All findings
published after the fix| ID | Finding | Severity | CVSS | Class | Status |
|---|---|---|---|---|---|
| WM-2026-001 | Next.js: middleware matcher leaves admin API routes unauthenticated | Critical | 9.1 | Broken access control | Fixed |
| WM-2026-002 | Next.js: server-side URL import reaches the cloud metadata service (SSRF) | Critical | 9.3 | Server-side request forgery | Fixed |
| WM-2026-003 | Go server: unauthenticated remote code execution through shell command construction | Critical | 9.8 | OS command injection | Fixed |
| WM-2026-004 | Python FastAPI: JWT signature is never verified, so any token is accepted | Critical | 9.1 | Improper authentication | Fixed |
Method
Model the trust boundary.
What does the system assume, what can cross the boundary, and what happens when it does?
Prove it, minimally.
Smallest reproduction in an isolated, reproducible environment. No real data, no collateral.
Disclose on a clock.
Report, acknowledge, patch, publish. 90 days unless agreed otherwise.
reportd0
ackd3
patchd58
publicd90