EL1SYUM
IDContact

Research index

Security research and technical investigations.

Work across modern web applications and APIs, presented with explicit scope, controls, limitations, and finding status.

Research methodology

Claims must survive controlled comparison.

The proof loop reduces false positives, separates assumptions from evidence, and supports reproducibility.

  1. 01Baseline

    Establish expected behavior.

  2. 02One-variable mutation

    Change one trust variable.

  3. 03Negative control

    Test a matched invalid case.

  4. 04Reproduction

    Repeat the observed behavior.

  5. 05Authoritative readback

    Verify canonical state.

  6. 06Cleanup

    Remove test state and verify.

Research publications and projects

2026

01AI Session Lifecycle & Post-Delete Data AccessSession Security · Technical Case StudyA bounded investigation of post-delete AI session behavior, presented as a technical case study with a NEEDS_MORE_EVIDENCE status.202602Seven Confirmed Security FindingsAuthorized Assessments · Redacted PublicationOne High, four Medium, and two Low findings validated through controlled testing and published in redacted form by CyberSecAudit.202603Independent Cybersecurity ResearchAuthorized Programs & Owned LabsEvidence-driven web and API security testing across authentication, authorization, business logic, and lifecycle boundaries.2026—Present04CyberSecAuditOwned Security & Monitoring ProjectRead-only monitoring and operational documentation for an owned public asset.2026—Present

Independent research

2026—Present

Authorized Programs & Owned Labs

Testing focuses on authentication, authorization, parent-child object binding, tenant context, lifecycle behavior, and old/new transport parity using permitted accounts and owned test objects.

The workflow includes HTTP request/response analysis, JavaScript call-site analysis, browser network traffic, API behavior, durable-state checks, evidence manifests, operational checkpoints, and cleanup after testing.

Owned project

2026—Present

CyberSecAudit

Read-only monitoring for availability, DNS, TLS, security headers, crawler accessibility, sitemap behavior, operational status, and the public funnel on an owned asset.

Supporting work includes security documentation, risk classification, and post-change verification with facts, hypotheses, and unproven results kept separate.

Open the project page