Research

Measured work, with the method and the limits stated in full. A number without its confidence interval is marketing; a finding without its reproduction steps is an anecdote. Everything here is reproducible on commodity hardware, and everything was tested against our own systems or under authorization.

• The Same Model, 4.6× the Exposure

  A measured look at prompt-injection resistance in a small local LLM — and why a single "resistance score" is misleading.

  2026-07-01

• Anatomy of an Exposed IAM Frontend

  A total authentication bypass on a Google-acquisition asset — and a precise account of why it was fixed in nine days, and correctly rewarded $0.

  2026-05-01