Secure Source-Code Review
Manual source-code review of security-sensitive code, with emphasis on authorization, data flow, trust boundaries, and exploitable implementation flaws.
Landing
Independent Application Security Research
Security research that starts in the code.
I’m Duy Tran, an application security researcher focused on source-code review, authorization boundaries, web/API security, and practical vulnerability validation. I work through authorized testing and coordinated disclosure.
What I do
Focused application security work for software teams.
Engagements are scoped around concrete attack surfaces and security questions rather than generic scanner output.
Web & API Security Assessment
Targeted testing for broken access control, authentication weaknesses, business-logic flaws, unsafe file handling, and other application-layer risks.
Focused Security Review
Review of a feature, patch, architecture decision, or suspected vulnerability when a team needs a narrow technical answer instead of a broad assessment.
Research
Public evidence, not marketing claims.
My research archive documents public vulnerability disclosures, CVE write-ups, technical validation, and the reasoning behind security findings.
Method
Evidence-driven review from boundary to impact.
Scope the system
Identify assets, actors, attack surfaces, trust assumptions, and the security question being tested.
Trace boundaries
Follow attacker-controlled data through authentication, authorization, persistence, and sensitive sinks.
Validate behavior
Use controlled runtime testing and negative controls to distinguish reachable impact from suspicious code.
Deliver evidence
Document reproducible findings, affected boundaries, impact, and remediation guidance without unsupported claims.
Newsfeed
Latest research, write-ups, and notes.
The original blog feed stays here as the living stream of new research and learning posts.
How Patchstack Is Devaluing Vulnerability Research
A researcher-side critique of Patchstack's shared bounty pool, duplicate risk, XP dilution, rejection penalties, leaderboard incentives, and the economics of vulnerability research.
Read postThe Security Bugs I Look for First When Reviewing a Codebase
When I review an unfamiliar codebase, I prioritize broken authorization, trust-boundary failures, alternate interfaces, sensitive state transitions, and data-lifecycle mistakes before cha...
Read postCVE-2026-16612: FiboSearch Autocomplete Exposed Password-Protected Products
FiboSearch exposed password-protected WooCommerce products through autocomplete search responses when the request came from a logged-in Subscriber session that had not entered the product...
Read postCVE-2026-15231: TaxoPress AI Preview Leaked Private Post-Derived Output
TaxoPress before 3.51.0 allowed Contributor-level users to reference private posts in the AI Preview workflow and receive output derived from posts they were not authorized to read.
Read postCVE-2026-15248: Meta Box Contributor+ Arbitrary Attachment Deletion
Meta Box versions before 5.13.1 allowed authenticated users with access to a file-field workflow to delete attachments belonging to other users because the deletion endpoint trusted reque...
Read postCloud, Virtualization, and Cloud Security Fundamentals
Beginner-friendly notes on virtualization, hypervisors, VMs, containers, cloud computing models, shared responsibility, cloud monitoring, and common cloud security mistakes.
Read postCVE-2026-11571: When an Email CSV Attachment Stayed Public in Everest Forms
Everest Forms versions up to 3.4.8 could leave generated CSV submission artifacts in a public uploads directory after a multi-notification email workflow, exposing form data to unauthenti...
Read postCVE-2026-11855: Forged Stripe Webhook Metadata to Admin-Context XSS in Simple Membership
Simple Membership 4.7.4 accepted unauthenticated forged Stripe webhook metadata when the signing secret was empty, then rendered the stored API version in an administrator notice without ...
Read postSecurity review
Need a focused review of your application or source code?
Send the product or repository context, technology stack, intended scope, and the security questions you want answered.
Authorized engagements only. Scope and testing boundaries are agreed before active security testing begins.