skeletonsec

research

Original vulnerability research only: 0/1/N-day analyses, root causes, exploitation, remediation, disclosure timelines. Everything here ships with evidence or it doesn’t ship. A bug without a reproducer is a rumor, and rumors don’t get published.

The archive is young. CTF writeups live under writeups, tool design notes under projects. When a disclosure is in flight, this index is where it lands — with the timeline table attached.

2026

medium

dissecting a git-exposure finding: anatomy of an information leak

target: self-hosted demo

A deploy that copies .git into the webroot hands attackers the repo, its history, and any credential in a remote URL. Full anatomy — root cause, request/response evidence, reconstruction, fix — against a self-hosted demo target.

skeletonsec is online

target: this site (meta)

The lab has a front door. What gets published here, and the rule it all answers to.