researcher@authorized-scope:~$ list ./findings
Sanitized technical reports from authorized security testing. Target identity, report identifiers and tenant-specific details are intentionally withheld; methodology, evidence boundaries and triage outcomes remain transparent.
Disclosure archive
Each article separates the verified behavior, reproducible evidence, practical impact, limitations and final program decision.
Blind SSRF / TCP reachability oracle
A sanitized bug bounty report documenting a repeatable timing oracle in an authenticated connection-validation workflow and the duplicate triage outcome.
Blind SSRF / DNS validation bypass
A controlled callback and timing analysis showed that a hostname resolving to RFC1918 space reached a backend fetch stage, with impact limited to blind reconnaissance.
Blind SSRF / SMTP reachability oracle
A sanitized report showing how an authenticated SMTP test feature exposed loopback and RFC1918 connection states through timing and error-class differences.
Publication standard
Observed timings, response classes and controlled callbacks are distinguished from impact that was not demonstrated.
The target, domains, report IDs, tenant identifiers, credentials and private program details are not published.
Validation used owned accounts and projects, low request volumes and non-destructive techniques within published scope.