I like figuring out how systems work. The interesting part starts when they don’t.

Hi, I’m 1w4y.

I work in Security Engineering, which mostly means helping systems make fewer dangerous assumptions.

I also do security research on the side—mostly because I’m not very good at noticing something strange and simply moving on. One unexpected response, an internal header in the wrong place, or a comment saying “this should never happen” is usually enough to start a new rabbit hole.

Sometimes it leads to a real vulnerability. Sometimes it ends as a false positive. Sometimes I just learn far more than I intended about one tiny corner of a codebase.

All three can be useful.

How I work

I want to know why something happens, not just whether I can make it happen.

I read the source, reproduce the behavior, follow it through the runtime, and check whether the idea survives contact with a real deployment. If it does, I keep digging. If it does not, I find out why.

I would rather be right than loud.

This site is where I keep the parts worth sharing: research, experiments, technical notes, wrong turns, and the occasional answer to a question nobody asked—but probably should have.

Research ethics

I only publish work based on authorized testing or publicly available material. The goal is simple: understand the system and leave it better than I found it.

If publishing a detail would make life easier for attackers and harder for maintainers, it does not need to be public yet.

Good research should help both the software and the people maintaining it.

Contact

Corrections and technical disagreements are welcome through GitHub. If I missed something, send the evidence. That saves everyone time.

For anything sensitive, please use the relevant vendor’s private security channel instead of opening a public issue.