Zero-Click Phishing & Email DoS via Google's Identity Toolkit

Zero-Click Phishing & Email DoS via Google's Identity Toolkit

How I discovered a logic flaw in Google's Identity Toolkit that allowed unauthenticated attackers to send unlimited official security notifications with content injection for high-fidelity phishing and DoS.

Manipulating LinkedIn's Search Algorithm and Poisoning SERP Results

How I discovered a validation and logic flaw in LinkedIn's Search Algorithm that allowed me to manipulate search results and poison the search experience for users.

P2/S2 Unauthenticated Redirect Loop Leading to DoS In Google Image Proxy

How I discovered a logic flaw in Google's internal proxy service that led to unauthenticated, attribution-free DDoS amplification and infrastructure resource exhaustion.

CVSS 6.5 Persistent State Corruption in Linear.app

How I discovered a logic flaw in Linear.app's optimistic UI architecture that allowed authenticated users to permanently 'brick' other accounts via ID collision, resulting in a persistent Denial of Service (DoS) with no recovery path.

CVSS 9.6 Account Takeover in Azerbaijan's Most Visited Platforms

How I discovered a critical Open Redirect to Account Takeover (ATO) vulnerability in Azerbaijan's largest online marketplaces, tap.az and turbo.az

Zero-Click Phishing & Email DoS via Google's Identity Toolkit

How I discovered a logic flaw in Google's Identity Toolkit that allowed unauthenticated attackers to send unlimited official security notifications with content injection for high-fidelity phishing and DoS.

Manipulating LinkedIn's Search Algorithm and Poisoning SERP Results

How I discovered a validation and logic flaw in LinkedIn's Search Algorithm that allowed me to manipulate search results and poison the search experience for users.

P2/S2 Unauthenticated Redirect Loop Leading to DoS In Google Image Proxy

How I discovered a logic flaw in Google's internal proxy service that led to unauthenticated, attribution-free DDoS amplification and infrastructure resource exhaustion.

CVSS 6.5 Persistent State Corruption in Linear.app

How I discovered a logic flaw in Linear.app's optimistic UI architecture that allowed authenticated users to permanently 'brick' other accounts via ID collision, resulting in a persistent Denial of Service (DoS) with no recovery path.

CVSS 9.6 Account Takeover in Azerbaijan's Most Visited Platforms

How I discovered a critical Open Redirect to Account Takeover (ATO) vulnerability in Azerbaijan's largest online marketplaces, tap.az and turbo.az