An OSWE-style white-box web review: read the source, identify the sink, reason the exploitation logic, verify, and remediate
A white-box secure code review of Larchmont Portal, a fictional partner-facing web application. Read the source, identify the vulnerable sinks, reason through the conceptual exploitation path, verify impact and scope, then write the remediation report. No exploit code involved — this is source-to-sink reasoning only.
A white-box secure code review of Meridian Ledger, a fictional Java/Spring expense-approval service. Read the source, decide which suspicious-looking code is actually safe and which isn't, reason through the exploitation path for what's genuinely wrong, verify impact and scope, then write the remediation report. No exploit code involved — source-to-sink reasoning only.
A white-box secure code review of Solstice Filedrop, a fictional Python/Flask file-upload service. Read the source, identify a genuine defect in how a file gets written to disk, reason through what would need to be true for it to matter, verify what the source can and cannot tell you, then write the remediation report. No exploit code involved — source-to-sink reasoning only.
A white-box secure code review of Anchor Freight, a fictional Node.js/Express logistics API backed by MongoDB. Read the source, find where an authorization check and the data it's supposed to protect have quietly come apart, reason through the exploitation path, verify impact and scope, then write the remediation report. No exploit code involved — source-to-sink reasoning only.
A white-box secure code review of Bastion Gateway, a fictional Go authentication service that verifies client bearer tokens against an RSA public key. Read the source, identify the sink, reason through the exploitation path, verify impact and scope, then write the remediation report. No exploit code involved — source-to-sink reasoning only.