I'm roro — an appsec engineer and independent researcher. This is where I write up vulnerabilities I've found, publish small tools, and think out loud about how modern software actually breaks.
How SEK combines deterministic CPG and source-analysis lanes with bounded LLM judgement, validation, persistence, and human review instead of turning the whole audit into one autonomous loop.
How SEK combines deterministic CPG and source-analysis lanes with bounded LLM judgement, validation, persistence, and human review instead of turning the whole audit into one autonomous loop.
Less technical than usual. The story of sek, the code audit tool I'm building: where the idea came from, my failed first attempt (spotted), the restart on Joern, the Rust backend I picked against my will, and the weird feeling of thinking you're done when you're not.
I found my first DOM-based XSS in a bug bounty program. No SQLi, no RCE - just a missing origin check in a postMessage listener and a javascript: URI. CVSS 9.0. Sink-to-source analysis, exploit chain, and some bonus impact.
A deep technical reference on how Semgrep works internally - from CLI entry-point and target discovery, through parsing, AST normalisation, pattern matching and taint dataflow analysis, to output formatting.
CTF reverse-engineering writeup: static analysis of a Windows crackme in Ghidra recovers an XOR flag from the decompilation, skipping every anti-debug check.
This article is the result of an OffenSkill Training. It discusses an unauthenticated arbitrary file read vulnerability found in the Enketo software, a web survey manager. The vulnerability, found during a white-box code review session, allows an unauthenticated attacker to read any arbitrary file on the server's by chaining an auth bypass, SSRF, XXE in svg and browser abuses.
About one email per month. Unsubscribe takes one click.
