Notes from competition and research work. We publish the reasoning, not just the payload — the route to a finding is the part that transfers to the next target.
A path-confusion primitive between an edge cache and an origin router turns an authenticated profile endpoint into a public one. Written as a layout sample, not as a record of a real challenge.
A single-byte overflow into a heap chunk header, escalated to a controlled write through unlink. Written as a layout sample, not as a record of a real challenge.
Competition notes, solutions and per-event structure live in the public repository.