Security research
When I find a vulnerability in software I use, I tell the vendor. Once a fix ships, I publish it here.
Reported vulnerabilities
2 findings became CVE records.
SOC · live monitoring
Missing WebSocket origin validation (Cross-Site WebSocket Hijacking)
Textream's local WebSocket server did not validate the Origin header. A malicious web page visited by the user could silently connect to it and send commands.
Resource exhaustion through unlimited connections (DoS)
Textream's WebSocket server imposed no limit on concurrent connections. Flooding it exhausted CPU and memory and could freeze the app during a live session.
How I work
Finding
I review software I use myself. When I find a flaw I confirm it with a proof of concept, without touching anyone's data.
Report
I notify the vendor privately, with reproduction steps.
Fix
I don't share details until a patch is released.
Publish
After the fix ships, the CVE record and the summary here go public.
