Problems Solved

Reported a Zillow Data Scraping Bug to Bugcrowd. They Said It Was Not Reproducible. Reddit Said It Was. Bugcrowd Threatened.

A security researcher discovered Zillow whitelists Google server IPs, letting anyone scrape listings via Google Sheets. Bugcrowd dismissed the report, then threatened the researcher for talking about it publicly. The disclosure process is broken.

Stripe Says Publishable Keys Are Safe to Expose. They're Not.

Stripe's documentation says publishable keys are "not secret" and safe to embed in client-side code. But attackers are using them to validate stolen credit cards at scale - and Stripe blames the merchants.

Safari Hanging on Page Reloads? OPNsense, QUIC.

Spent a week debugging Safari hanging on page reloads. Turns out it was my OPNsense firewall's UDP timeout killing idle QUIC connections. Here's how to fix it.