> BLOG_

Aug 4, 20269 min read

How a Single File-Read Bug Became Root Cloud Access

An authorized assessment where a boring, unauthenticated Local File Inclusion got patiently walked up a ladder of secrets — from one config file to forgeable trusted URLs and, ultimately, root cloud credentials. High-level, responsibly disclosed, all secrets removed.

Cybersecurity
LFI
Cloud Security
Web Security
Apr 15, 20258 min read

How I Hacked the HOR Berlin DJ Competition

How I discovered a vote manipulation vulnerability in HOR Berlin's Maximum Heat DJ contest — a WordPress voting plugin with zero rate limiting and no server-side validation.

Cybersecurity
WordPress
Web Security
Feb 13, 202610 min read

DIY Omi

How I built my own Omi device from scratch — flashing custom firmware and programming it to generate MIDI files from melodies it hears.

Hardware
Firmware
MIDI
DIY
Feb 13, 202612 min read

The Way We Access Digital Music Needs to Change

A breakdown of Sleepy MP3 Downloader — a browser plugin that exploits code injection and weak API security on SoundCloud and Bandcamp to give artists and listeners the tools they deserve.

Web Security
Browser Extensions
Music
JavaScript
Feb 13, 20267 min read

DIY Touch Synth

How I built a custom touch synth from a bare PCB — hand-soldering every component to create an instrument that works as both a standalone synth and a MIDI controller.

Hardware
DIY
MIDI
Music