2026Security

Security

Two podiums, one invite-only call-up, my own capture-the-flag challenges, and a real leak I reported instead of used.

Lock the table and ask it again, with the key every browser gets. Demo data only.

Capture the flag

PECAN+ CTF

CSECcon CTF, UTS: 3rd place, CSECcon CTF, UTS (2026).
ADF Cyber Skills Challenge: Invited to the ADF Cyber Skills Challenge (invite only, November 2026). adfcsc.au
My own challenges: I write my own CTF challenges. One boots an old Linux kernel in QEMU, so the privilege escalation you work through is real, not simulated.

What broke: A live startup's site exposed its paying customers' email addresses and its paid content. Row-level security on its Supabase database was not restricting reads, so the public key that every visitor's browser is given could read those tables.
How I found it: I noticed it while studying how the site's front end was built. To confirm it, I recorded only row counts and field names. I did not read or keep any values.
How I reported it: Privately, to the founder, with the fix written out. I did not publish it, and I did not use it. The founder thanked me.
The fix: Row-level security on every table, policies that grant each role only what it needs, and the paid content served only through an authenticated route.

The company is not named here, on purpose. Finding it was the easy part; the skill is in what you do next.