independent security research
I'm Mara Vesk // @m4ra. I break software on purpose so the people who ship it don't have to find out the hard way.
$ cat whoami.md
I'm a full-time independent security researcher. My work sits at the point where a system does something its designers never intended — a length field that's trusted one instruction too early, a token verifier that resolves a path it should treat as opaque, an allocator reference that crosses a trust boundary.
Most of what I do is unglamorous: reading code carefully, building harnesses, triaging crashes, and proving — to myself and then to a vendor — whether a finding is exploitable or just noise. The advisories on this site are the small fraction of that work that ended in a tracked, patched CVE.
I disclose everything responsibly. Vendors get a private report and a reasonable window to ship a fix before anything is published. That policy is non-negotiable and it's written down on thedisclosure page.
$ man mara
A working researcher's loop — not a buzzword cloud. Three phases, repeated until the bug is dead.
Source and binary auditing, reverse engineering on x86-64 and ARM64, and structure-aware fuzzing of parsers and protocols. Mostly slow, careful reading.
Memory-corruption primitives, heap grooming, ASLR/CFI defeat, sandbox and VM escapes — turned into a minimal proof of concept that demonstrates real impact.
Coordinated disclosure, CVE and advisory authoring, and the very human work of liaising with a vendor PSIRT until a patch actually ships.
$ grep -l "exploitable" advisories/
A session-ticket parser trusts an attacker-controlled length field before bounds checking, allowing a remote unauthenticated heap overflow during the TLS 1.2 resumption handshake. Reliable code execution was demonstrated against the default appliance build.
The token verifier resolves the JWT 'kid' header as a filesystem path without canonicalization, letting an attacker point key lookup at a predictable empty file and forge tokens signed with an empty HMAC secret. Full account takeover follows for any tenant.
An EXIF caption field is concatenated into a SQL statement during media import. A low-privileged editor can chain the injection with the engine's INTO OUTFILE primitive to drop a PHP stub into the webroot, escalating to remote code execution.
$ open secure-channel
I take reports seriously and I credit the people who send them. If you've got a finding — or you want an extra set of eyes on a system before it ships — get in touch.