VYN / RSRCHBeyond the hackbot: how AI-assisted vulnerability research works
Why heuristics, steering, evidence, and persistent memory matter more than raw volume when searching for real vulnerabilities.
Articles
Analysis, methods, and field notes from research conducted on real products.
06VYN / RSRCH
VYN / RSRCHInvisible Prompt Injection Chain Leading to Private Conversation Data Exfiltration
How invisible Unicode, a remote second stage, and external browsing can turn public content into an exfiltration channel.
VYN / RSRCHPrototype-Based Tool Allowlist Bypass in Vercel AI SDK MCP Client
How an inherited-property check allowed unapproved MCP tools to be exposed and executed.
VYN / RSRCHNext.js Vulnerability: Accessing Protected Static Routes in App Router via RSC Segment Artifacts
An internal build artifact in Next.js let attackers reach content protected by proxy/middleware without authentication (CVE-2026-44575).
VYN / RSRCHBypassing BODY_SIZE_LIMIT in SvelteKit adapter-node via chunked requests
How chunked requests without Content-Length bypassed the body size limit in SvelteKit's adapter-node (CVE-2026-40073).
VYN / RSRCHPrompt Injection in Bug Bounty: Vectors, Techniques, and Real-World Impact
A practical guide to indirect injection attacks and real-world impact.