I did a Hackalong over at Critical Thinking. The target was Superhuman (formerly Grammarly) and I found one bug on-stream - a classic AI data exfiltration. Rest assured the complete chain is not in the recording - I finished the chain and reported it with Valentino after the stream. It felt good to hack something again, as recently I’ve been spending all of my time on building my startup platform.

On that topic, I’m making great progress with the startup MVP, which is almost at a V1 now. Building enterprise-ready systems is challenging and the scope of what needs to be done is quite broad. I went to a founders’ meetup locally and I gained some great insights into what it’s like to run a company - there was a multi-time founder there answering fireside questions, so I really found that valuable. For my development cycle, I’ve been bouncing between using Opus and Claude Code on both CLI and the mobile app to plan new features, and implement them, and I’ve been using GPT5.5 on Codex to smooth out the entire system - all AIs have their shortcomings.

I am, generally, non-confrontational, which has numerous downsides. I was examining my credit card point stacking system, and it occurred to me that I should probably ask if there are any offers for loyalty or renewal - lo and behold, there were! So they offered me a nice chunk of points just for staying with them. Sometimes just asking goes a long way.

Following along this type of system, I’m trying to write some harnesses for each part of my life to optimise it as a whole. There’s probably a lot of optimising that I could do, but as rez0 put it, I have a limited number of human tokens and I don’t think I could keep track of everything. So I had the thought to harness things and have an LLM find the stuff that I can optimise a bit better. This could be as simple as using a credit card with a slightly better cashback scheme that would add up in the long run. These incremental gains across many different optimisations could result in a 20%-30% gain or more across the board, so that was and is my goal with this idea. I want these subsidised tokens to pay attention to the stuff where I’d learn absolutely nothing if I did it myself.

And finally, following along from that train of thought, it’s important to distinguish between the benefits of AI that are just marketing posture and a fear of getting outdone by a competitor, versus a real tangible benefit that could survive on local models in a worst-case scenario. Because most of the stuff out there is just acting on fear-mongering. It’s easy to get caught up in the hype.

From Tomcat JMX Proxy to RCE via AccessLogValve Injection: Superbly high-quality research from Hacktus on Apache Tomcat exploitation.

HTTP desync in Discord's media proxy: Spying on a whole platform (2022): Desync in Discord. Yeah. That’s pretty horrifying.

$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain: A really awesome 2FA bypass. I can appreciate a good server-side Javascript bug.

HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555): This is extremely high-quality research. Definitely one of those Portswigger Top 10 candidates for next year.

Leaking YouTube Creators Private Videos: This was apparently marked as a non-issue by Google. That surprised me because it seems perfectly valid to me.