INDEPENDENT SECURITY RESEARCH

Finding the cracks
between trust boundaries.

Android, mobile applications, WebViews, deep links, native bridges, web applications, APIs, reverse engineering, and reproducible PoCs.

Read write-ups About me

01Android / Mobile

WebViews, deep links, native bridges and client-side attack surfaces.

02Web / API

Endpoints, authentication, authorization and application trust boundaries.

03Proof over theory

Practical research with clean, reproducible proof-of-concepts.

FIELD NOTES

Latest write-ups

High · Published19 Aug 2026

Cross-Session Session Leakage Through Cached Next.js Responses

How a shared CloudFront cache exposed an HttpOnly session credential embedded in server-rendered Next.js responses.

WebNext.jsCloudFrontSession ManagementCDNInformation Disclosure

RESEARCH

Notes & articles

WebView ↔ Native Bridges: where trust boundaries get interesting

A short field note on why WebView-to-native interfaces deserve careful threat modeling.

AndroidWebViewMobileResearch

research@womp:~

$ whoami
womp — independent security researcher

$ focus --current
android · webviews · api · reverse-engineering · web

$ methodology
"practical research + reproducible PoCs"