Notes from the exploit lab.
Vulnerability research, advisories and engineering write-ups from the team building Opsec.
- Product
Why we're funding research into making the web safer
The Opsec Research Fellowship funds independent security researchers to find vulnerabilities in critical software and publish the work. Full research costs covered, plus up to $3,000 in early Opsec allocation for strong results.
4 min read - Product
Workflows: your fleet against the swarm
Attackers now run agents in parallel while defense still works one ticket at a time. Defense needs a fleet of its own, and Workflows brings that fleet to every security team.
5 min read - Research
Exploitable reentrancy in contracts that already passed an audit
What we learned running exploit validation against a set of previously audited lending and vault contracts.
9 min read - Engineering
Why we rank findings by exploitability, not severity
A generic severity score says how bad a bug could be somewhere. Exploitability says whether it can hurt you here.
6 min read - Advisory
Session identifiers that survive login in custom PHP auth flows
A recurring pattern in hand-rolled authentication: privileges change, the session ID does not.
4 min read - Engineering
How Opsec runs entirely inside your perimeter
A look at the deployment architecture that keeps source code, findings and models inside infrastructure you control.
7 min read