Web security & vulnerability research

Beneaththe surface.

I’m Joshua, a security engineer at Tenable.
I research web vulnerabilities, build tools,
and write about what I find.

Explore my research

FIG. 01 — FROM CLICK TO PATCH

Click. Break. Patch. Hover to take the cursor.

A public record of asking questionsResearch archive

Published CVEs: 66
Critical findings: 15
Products affected: 29
Years disclosing, since 2020: 6+

02 / SELECTED WORK

Following the evidence.

All disclosures

CVE-2026-20896Critical

Broken Authenticationin Gitea

An authentication flaw in Gitea. Read the vendor’s release notes and security advisory.

2026 · VendorRead advisory

CVE-2026-82123Medium

Reflected XSSin WordPress Loops & Logic

A reflected cross-site scripting vulnerability in WordPress Loops & Logic. Read the disclosure.

2026 · TenableRead advisory

03 / FROM THE NOTEBOOK

Research, written down.

08 SEP 202628 MIN READ

Bugbounty agent benchmark

Six models. Seven harnesses. One browser. What actually makes a bug bounty agent better?

From the article

“I wrote the specification before any code. Goals and non-goals, vocabulary, the invariants a proof has to satisfy, the scoring rule, the analysis plan.”

aibugbountyRead article

04 / BUILT ALONG THE WAY

Tools for the work.

WebSec0

Grades a site’s TLS setup and HTTP security headers, and explains how to fix what it finds.

Detective

Recon pipeline: subdomains, DNS, CDN detection, ports and web services, streamed to your API.

Hookd

Interaction server capturing out-of-band DNS, HTTP and SMTP callbacks through ephemeral hooks.

05 / GET IN TOUCH

Let’s compare notes.

A question about a finding, an idea to explore, or a speaking invitation?

contact@jomar.fr