A public-safe record of Jake Babula's scope-first application-security research. The emphasis is not volume; it is defensible evidence, explicit uncertainty, and coordinated disclosure.
flowchart LR
S[Verify scope and policy] --> V[Pin exact version]
V --> R[Reproduce locally]
R --> N[Run negative controls]
N --> I[Establish security impact]
I --> D[Review duplicates and disclosure status]
D --> P[Publish only when cleared]
Every public case study should answer:
- What exact asset and version were tested?
- What was authorized?
- What was directly observed versus inferred?
- What negative control rules out the ordinary explanation?
- What user or trust boundary is crossed?
- What was not tested?
- Has the vendor cleared publication?
Vendor-specific technical details are published only when the disclosure status is verifiable and publication is safe. Drafts, active reports, ambiguous outcomes, credentials, customer data, private correspondence, and live exploit paths do not belong here.
Proton research is intentionally excluded while confidentiality remains active. This repository does not confirm, deny, summarize, or hint at unpublished Proton findings.
| Research area | Public status | Portfolio claim |
|---|---|---|
| Open-source network-listener review | Closed as a duplicate of prior work | A scoped report was submitted; no originality, reward, or vendor-credit claim |
| Public-source authorization review | Not cleared for technical publication | Withheld |
| Developer-tool trust-boundary research | Not cleared for technical publication | Withheld |
| Proton research | Confidential | Excluded |
The log is intentionally less detailed than private research records. A sanitized technical writeup is added only after the corresponding vendor or program status permits it.
- Evidence before severity — a methodology case study on separating source-level data flow from a demonstrated authorization bypass.
- Safe proof design — how synthetic fixtures and negative controls produce useful evidence without touching real credentials or third-party data.
These are generalized research notes, not disclosures of active vendor vulnerabilities.
- Stay inside the published program scope and safe harbor.
- Prefer local, synthetic, non-destructive reproductions.
- Never use real credentials, funds, wallets, passkeys, customer data, or third-party accounts without explicit authorization.
- Stop when impact depends on an unapproved action.
- Treat “not report-ready” as a valid outcome.
- Do not overstate a duplicate, informational response, source-only concern, or unverified exploit.
Use the contact method on the GitHub profile for coordinated disclosure. Do not open a public issue containing an unpatched vulnerability, secrets, personal data, or exploit evidence.