Red Guy's Path: A Don't Hug Me, I'm Scared CTF for DEF CON
Why I Built This I'm going to DEF CON. Online I go by Red Guy — Don't Hug Me I'm Scared bit, not a full cosplay thing. I'll probably be in a Red Guy shirt so I'm easier to find in
Building the IoT Railroad: Smart Control for a Classic DC Layout
🧠Why I Built This This project started like a lot of mine do: I wanted to combine something nostalgic with something technical. After relocating and downsizing my layout space, I saw an opportunity to do something different with my model train setup—integrate it with my homelab and smart control
findaredbox.kbots.tech: Mapping the Ghosts of Redbox Kiosks
🧠Why I Built This Redbox may be going the way of the DVD itself—but the machines are still out there. Some are still operational, others have been shut off, removed, or never even deployed. And after the company's bankruptcy and shifting digital priorities, their official locator isn’
My Hacker Toolkit
🧠Why This Toolkit Exists Every good exploit starts with curiosity—and sometimes a hunch. Over the last few years, I’ve disclosed vulnerabilities ranging from GraphQL overexposures in social apps like Fizz and YikYak to full API-level data leaks in life safety infrastructure—one of which became CVE-2025-0352 and was
Too Close for Comfort: Location & User Data Exposure in YikYak's GraphQL API
⚠️ Transparency Statement All findings described below were discovered through traffic analysis of my own user account using standard tools. No unauthorized access occurred. This post serves as a permanent public record of what was found. Since YikYak is no longer in operation with this API or backend, redaction is not
Alarmed and Dangerous: A Security Researcher’s Look Inside a Monitoring App Vulnerability
👋 Introduction: Why I Do What I Do I work in cybersecurity, but even outside my day job, I often investigate the apps and services I use. It's part curiosity, part self-defense—and sometimes, it reveals something a little too real. This time, my digging uncovered a severe security
Leaking Loudly: Public Backups, Posts, and PII from Fizz’s CDN
⚠️ Note on Redaction & Intent All personal and confidential information has been redacted from any screenshots or data. All data described here was publicly accessible without login or authorization at the time of discovery. This write-up is brief and intended primarily as a public record, not a technical walkthrough. 📅 Discovery
Airbuds.fm: GraphQL Privacy Oversight in a Social Music App
🧠Why I Looked Into This In early October 2024, I started investigating the Airbuds.fm app. At the time, it had grown to over 3 million users and ranked among the top 10 music apps on the App Store. Airbuds.fm is a social music app that lets users share