Private · Self-hosted · Verified
Notes from the exploit lab.
Vulnerability research, advisories and engineering write-ups from the team building Opsec.
- Research
Exploitable reentrancy in contracts that already passed an audit
What we learned running exploit validation against a set of previously audited lending and vault contracts.
9 min read - Engineering
Why we rank findings by exploitability, not severity
A generic severity score says how bad a bug could be somewhere. Exploitability says whether it can hurt you here.
6 min read - Advisory
Session identifiers that survive login in custom PHP auth flows
A recurring pattern in hand-rolled authentication: privileges change, the session ID does not.
4 min read - Engineering
How Opsec runs entirely inside your perimeter
A look at the deployment architecture that keeps source code, findings and models inside infrastructure you control.
7 min read