Now

Nullsec (https://nulls.ec) - a mobile reverse-engineering playground: on-demand research devices, agents, and the orchestrator that drives them. Most of my waking hours go here.

Untrust Labs (https://untru.st) - account intelligence: give it one identifier (email, phone, username, crypto address) and it resolves the accounts behind it, with virtual investigation devices to run the workflow end to end.

One advisory is in coordinated disclosure: a 21-byte crash in a widely used HTML sanitizer, filed privately on 2026-08-20 (GHSA-jm4j-9c88-3hxm, in triage). The write-up is embargoed until it publishes.

Reading up on parser differentials in HTML sanitizers: the same spec-vs-implementation gap keeps paying out across ecosystems.