INDEPENDENT SECURITY RESEARCH

Finding the cracks
between trust boundaries.

Android, mobile applications, WebViews, deep links, native bridges, web applications, APIs, reverse engineering, and reproducible PoCs.

Read write-ups About me

01Android / Mobile

WebViews, deep links, native bridges and client-side attack surfaces.

02Web / API

Endpoints, authentication, authorization and application trust boundaries.

03Proof over theory

Practical research with clean, reproducible proof-of-concepts.

TARGETNo active research

AREACurrently offline

FOCUS

No active focus

FIELD NOTES

Latest write-ups

View all →

Critical · Published20 Aug 2026

How to pwn a website and take over any account

How a broken password-reset flow exposed recovery secrets to unauthenticated users and turned account recovery into a complete account-takeover primitive.

WebAPIAuthenticationAccount TakeoverPassword ResetInformation Disclosure

High · Published19 Aug 2026

Cross-Session Session Leakage Through Cached Next.js Responses

How a shared CloudFront cache exposed an HttpOnly session credential embedded in server-rendered Next.js responses.

WebNext.jsCloudFrontSession ManagementCDNInformation Disclosure

RESEARCH

Notes & articles

View all →

19 Aug 2026

WebView ↔ Native Bridges: where trust boundaries get interesting

A short field note on why WebView-to-native interfaces deserve careful threat modeling.

AndroidWebViewMobileResearch

research@womp:~

$ whoami
womp — independent security researcher

$ focus --current
android · webviews · api · reverse-engineering · web

$ methodology
"practical research + reproducible PoCs"