Get in touch
Let’s build something secure together. Use the form below to reach out.
Security Contributions
Hall of Fame listings with the name hcnpeiris · Click a name to view the Hall of Fame page.
Writing
Notes on security research, web architecture, and things I learn while building.
How X-Forwarded-Prefix and protocol-relative URLs enable CVE-2026-27738 and CVE-2026-33397 bugs.
Read article
Using URL encoding variations and parser differentials as a cache-busting technique to hunt poisoning bugs.
Read article
Explains two Angular SSR SSRF CVEs (2025-62427, 2026-27739): how malformed Host/URL inputs let attackers hijack the request origin.
Read article
Build a Raspberry Pi homelab to safely recreate web app stacks, test vulnerabilities, and hunt bugs.
Read article
BOLA plus javascript: URI injection let attackers steal JWTs and hijack any user or admin account.
Read articleSecurity Researcher & Web Developer
Building reliable, secure, and modern web experiences — from architecture to deployment.
Resume Read BlogSecurity Contributions
Hall of Fame listings with the name hcnpeiris · Tap a name to view.
Get in touch
Let’s build something secure together. Use the form below to reach out.
Writing
Notes on security research, web architecture, and things I learn while building.
How X-Forwarded-Prefix and protocol-relative URLs enable CVE-2026-27738 and CVE-2026-33397 bugs.
Read article
Using URL encoding variations and parser differentials as a cache-busting technique to hunt poisoning bugs.
Read article
Explains two Angular SSR SSRF CVEs (2025-62427, 2026-27739): how malformed Host/URL inputs let attackers hijack the request origin.
Read article
Build a Raspberry Pi homelab to safely recreate web app stacks, test vulnerabilities, and hunt bugs.
Read article
BOLA plus javascript: URI injection let attackers steal JWTs and hijack any user or admin account.
Read article