SECURITY RESEARCHER / BUG BOUNTY
I'm Gabb1337. I research vulnerabilities in applications, APIs, devices and smart contracts. I turn hypotheses into reproducible tests, and evidence into reports.
RESEARCH SCOPE
SURFACES & BOUNDARIES
The same question, across every surface:
What can an actor do that the system should prevent?
00 ABOUT / RESEARCH FOCUS
I'm Gabb1337, an independent security researcher and bug bounty hunter. I study how permissions, identity and state behave when they cross application boundaries.
My work combines code review, differential testing and reproducible proof of concept development. I document what a test demonstrates, what it leaves uncertain and what another researcher needs to repeat it.
Interested in application security research, technical collaboration and opportunities to investigate complex systems.
01 RESEARCH FILES
Selected from my bug bounty research records. Cases are summarized by vulnerability class, with program, target and third-party identities withheld.
Compare the host application's rejection with the behavior of an integration using the same limited identity.
Focus: the difference between application context and object-level access.
Trace a revocation event across the current session, credential renewal and an already established connection.
Focus: consistency across channels, tested in an isolated environment.
Follow configuration data through a binary and separate emulated observations from physical-device validation.
Focus: data flow, simulated dependencies and the limits of each proof.
Status is part of the evidence. “Submitted” does not mean accepted or rewarded. Case studies reflect the local records reviewed, rather than live platform status. Payloads, versions, endpoints and identifiers are withheld.
DISCLOSURE02 RESEARCH PROTOCOL
My workflow connects scope, test identities and controls to the impact actually observed.
Read the scope, model actors and permissions, and identify the control that should protect the operation.
SCOPE / THREAT MODELCompare an authorized baseline, a negative control and a variant with one narrowly defined change.
BASELINE / CONTROL / VARIANTReproduce the behavior using my own accounts, data or environments. Record preconditions and limitations.
REPRODUCE / CORROBORATEDeduplicate by root cause, document evidence, propose a fix and clean up test artifacts.
DEDUPE / REPORT / CLEANUPBugcrowd / HackerOne / HackenProof
PLATFORMS ≠ DISCLOSED TARGETS03 KNOWLEDGE SYSTEM
My Obsidian vault brings together hypotheses, session notes, reports, controls and study references. Every claim has context and a decision that can be revisited.
The methodology separates facts, indicators and conclusions. Contradictions are recorded too: ruling out a hypothesis is a useful result.
PRIVATE VAULT / RECREATED PUBLIC VIEW
04 SURFACES & TECHNIQUES
IDOR / BOLA · XSS · Authentication · OAuth · Business logic
Revocation · Refresh tokens · WebSockets · User and project boundaries
Android · WebViews · Static and dynamic analysis · Binary emulation
SSRF · Egress controls · Data isolation · Move and Solidity invariants
PoCs · Differential testing · Negative controls · Reports · Deduplication
05 PUBLIC LAB / SYNTHETIC MODELS
Three small, reproducible teaching models. Change the enforcement policy and compare the observed result with the expected rule.
LOCAL COMPUTATION / NO NETWORK REQUESTS
Researcher A belongs to Project A. A second synthetic object belongs to Project B.
Enable JavaScript to run the models, or download the standalone source below.
READY / SYNTHETIC DATA
RUN LOCALLY node lab-models.mjsThree models · built-in checks · no dependencies
06 MISSION LOG / ON X
Selected publications from @Gabbsec1337 ↗. Research milestones, retests and observations from the process.
“It was about time to add another xss!”
A short update from an ongoing application-security research track.
READ ORIGINAL POST“Today's reward, very grateful!”
A public post celebrating a bug bounty reward, tagged with broken access control. No program or reward amount is reproduced here.
READ ORIGINAL POST“it was indeed patched.”
A follow-up describing a known-issue response and a negative retest after a reported patch. A reminder to record outcomes as carefully as initial observations.
READ ORIGINAL POST07 ESTABLISH CONNECTION
GABB1337 / SECURITY RESEARCH