Our own research, from report to training data

Every report in the training material comes from our own paid research. It covers web applications, frontends, backends, DeFi, CeFi, wallets, DEXs and smart contracts. We completed fine-tuning in November 2026.

Used in our daily work

We use Perpetuum-1 to discover vulnerabilities across bug bounty programs. We did not fine-tune it to inflate benchmark scores. We assess it through the work we use it for: finding vulnerabilities, explaining their impact and identifying fixes.

Codebases and every new push

Perpetuum-1 can review your codebase in full. Once integrated, it also reviews every code push automatically and suggests fixes. Both custom variants, Perpetuum-1 DS and Perpetuum-1 GLM, run in every review.

Integration typically takes around ten minutes once access is approved.

Managed coverage

Managed coverage includes Perpetuum-1, manual security audits and full support. Talaria Security Labs validates findings against your code to further reduce false positives and helps your team resolve them. You receive findings in the dashboard and through your preferred channel, including Slack, Microsoft Teams or email.

A completed transfer marked as failed

The issue arose when a Stellar transfer was wrapped in a fee-bump transaction. The transfer completed on-chain, but Coinbase’s internal withdrawal handling could treat the original transaction as failed. That mismatch created a risk of counting the same spend twice.

How fee-bump transactions work

Stellar allows another account to pay a transaction’s fee. The fee payer wraps an already signed transaction in a new envelope and adds a separate signature. The original transfer does not need to be signed again.

The fee-bump result includes the result of the inner transaction. A withdrawal system needs to reconcile both: a different outer envelope does not mean the underlying transfer failed.

Coinbase’s response

After our report, Coinbase paused the affected flow, confirmed the fix and restored processing. Coinbase reported that no customer funds were affected and that it found no exploitation beyond the proof of concept and internal tests.

Jose Almeida and Anh Nguyen carried out this research. Coinbase credits them in its disclosure; the finding was discovered manually.

Our team at H1-65

Jose Almeida and Anh Nguyen represented Talaria in Singapore. The Best Collaboration award was shared with other H1-65 participants.

The H1-65 trophies

Our OKX Eliminator and Best Collaboration trophies from Singapore. HackerOne published the full event results on 6 October 2025.

Original photograph ↗

A familiar name, a different domain

By constructing a long subdomain, we could leave a recognizable name visible while pushing the registrable domain outside the displayed label. The prompt could therefore suggest a different site from the one requesting access.

Our proof of concept followed the wallet connection and signing steps. Exploitation required the user to approve those actions.

The approval screen needs the full origin

We recommended showing the requesting origin clearly throughout connection and signing, including when a hostname is unusually long. The domain that controls a request needs to remain visible.

We submitted report #32459 to the Fuel Network Attackathon on 22 June 2024 under UGWST_COM. Immunefi classified the finding as Low severity.

The access was in a connected service

The account could create users, change permissions and modify scripts delivered to multiple frontends. Those permissions gave us a route into the application through its analytics service.

What the permissions allowed

Analytics and tag-management scripts run inside the application’s pages. Anyone who can change them can affect the code users’ browsers execute. Reviewing the application repository alone would have missed the account that controlled this access.

Reporting and remediation

We documented the permissions and their effect on the frontend, reported the finding to the client and worked with the development team on remediation. The audit took place in May 2022; we first published Jose Almeida’s write-up in January 2024.

The client and analytics provider remain unnamed.

Check who can publish scripts

Include connected analytics and tag-management accounts in a frontend security review. Check who can edit scripts, who can grant that permission and whether anonymous or default accounts inherit it.

Next.js configuration across the frontends

Our findings involved Next.js configurations used by multiple web interfaces. They exposed stored XSS and SSRF in the applications around Aurora and Rainbow Bridge.

The affected surfaces were the frontends. Their configuration and request handling needed review alongside the protocols they exposed to users.

Bounty and disclosure

We received a reward of $50,000 equivalent in AURORA tokens on 1 December 2022. Aurora published the findings and reward in its bug bounty report in November 2023.

A redirect changed the displayed origin

A malicious dApp could use a redirect to appear under a different origin in MetaMask Mobile. The attack still required the user to connect their wallet to that dApp.

We submitted report #1751333 on 26 October 2022. MetaMask resolved it and rated it High, with a CVSS score of 7.1. The report became public on 4 July 2023.

An Android deeplink started a download

The second issue allowed a deeplink to trigger a file download without the expected user prompt on Android. We submitted report #1768166 on 9 November 2022; MetaMask resolved it at Medium severity and disclosed it on 7 July 2023.

The demonstrated impact was an unwanted download. We did not demonstrate code execution through it.

Interfering with an approval

Our finding involved extension resources exposed to web pages. A malicious site could use those resources to manipulate the context around an approval interaction and mislead the user into clicking.

SlowMist’s subsequent reproduction examines the exposed resources and the phishing-warning page involved in the attack.

Fixed in version 10.14.6

MetaMask patched the browser extension in version 10.14.6 and reported no known exploitation. The issue affected the extension; its mobile application was not affected.

Independent analysis

SlowMist published a technical reproduction after the disclosure. Intigriti later used our finding in its guidance on assessing business impact, showing why a familiar vulnerability class can still have critical consequences.

Long hostnames hid the controlling domain

René’s report led to Brave emphasizing the registrable domain and wrapping long hostnames instead of clipping them. A familiar-looking subdomain should not hide the domain that actually controls the request.

Later prompts lost the origin

We also reported that the origin shown during connection was missing from several subsequent wallet actions. Brave added it to transaction confirmations, signing prompts and suggested-token panels.

The changes shipped

Brave merged the hostname change in March 2022 and the additional approval-panel work on 20 April. Its QA team verified the changes across Linux, Windows and macOS in May. Version 1.39.111 includes the domain-display improvement and credits René in the release notes.

An image request returned executable content

A Next.js image endpoint reflected input in its missing-file response without the content-type protections needed to prevent MIME sniffing. The browser could interpret the response as code running under the affected Lido origin.

Four frontends and a separate redirect issue

We reported code injection affecting four frontend domains. We also found an open redirect on two informational sites. Lido classified the code injection as Critical and the redirect as Low.

Patched within 5.25 hours

We submitted the findings on 21 February 2022. Lido patched all reported domains within 5.25 hours and reviewed its access logs, reporting no affected users.

Lido awarded separate Critical and Low-tier bounties and published its account on 1 March. The bounty amounts were not disclosed.

Reading server files through a Wiki page

With Kroki integration enabled, we could use a crafted AsciiDoc Wiki page to bypass restrictions on PlantUML includes. Asciidoctor’s attribute and counter handling allowed local file content to be included in encoded diagram requests.

GitLab assigned CVE-2021-22203 and awarded $5,600 for the server-file disclosure. We submitted the report on 8 February 2021; it was disclosed on 21 May.

Leaking an internal Workhorse token

A Terraform-state upload route and Workhorse interpreted a crafted path differently, exposing a valid internal JWT. We then used that token against a Geo-related path to demonstrate repository push access beyond the intended permissions.

We submitted the report in November 2020. GitLab assigned the High-severity CVE-2021-22190 in April 2021. The full report became public in July 2022, with a $10,000 bounty.

An SSH certificate name became a key identifier

GitLab Shell used a regular expression that did not match the entire input. A specially formed username in an SSH certificate could be interpreted as another user’s key identifier.

This required a certificate-based setup and a certificate authority willing to issue the crafted principal. GitLab assigned CVE-2021-22254 and rated the impersonation issue Low.

Talking with Reddit’s security team

The conversation covered Reddit’s program, how its security team handled reports and our experience researching the platform. René spoke alongside Allison Miller and Spencer Koch in the interview published by HackerOne on 14 April 2021.

Why we return to a target

René discussed revisiting endpoints, following product changes and returning with new ideas. Familiarity with a system can reveal things a first pass misses, particularly as the product evolves.

An authorization code reached the wrong domain

In the GitLab Pages custom-domain flow, an OAuth authorization code could be delivered to a domain we controlled. A legitimate authorization process was sending its result outside the intended destination.

Anh submitted the report on 16 November 2020 under ledz1996.

GitLab’s Most impactful finding award

GitLab selected Anh’s report for the award in its 2020 bug bounty review. The review, published on 14 December, recognizes the impact of the token-theft finding.

Combining upload and download behavior

A crafted filename could launch an installed application without passing arguments. We combined this behavior with a LINE Keep upload-filter bypass and a downloaded Terminal file.

Gatekeeper was a prerequisite

The code-execution chain worked with Gatekeeper disabled. This requirement limited the affected configuration; the same chain did not establish code execution on a default macOS installation.

Report and disclosure

Jose Almeida and René Kroka submitted the joint report on 2 November 2019, before UGWST was founded. LINE disclosed it on 31 July 2020 as report #727727.

The link looked like a trade offer

Steam Chat rendered the URL using the presentation associated with a trade offer, even though the destination could be an external site. That gave an attacker a way to disguise where a click would take the user.

The finding concerned link presentation and phishing risk. It did not allow automatic account access or inventory transfers.

Valve resolved the report

Jose submitted the finding on 24 November 2019. Valve classified it as Medium severity, marked it resolved and disclosed it on 19 February 2020.

Gatekeeper and an NFS mount

The issue involved autofs and an attacker-controlled NFS mount. A malicious application could use this path to bypass Gatekeeper’s checks.

Apple’s security update

Apple added improved checks in its 28 January 2020 macOS security release. Its advisory credits Jose Castro Almeida and René Kroka for the report and tracks the issue as CVE-2020-3866.

JSON interpreted as code

The Styles API returned JSON, but Internet Explorer 11’s MIME sniffing could treat attacker-controlled content in the response as executable code. The response lacked X-Content-Type-Options: nosniff.

Mapbox added response protections

René submitted the report on 24 December 2019. Mapbox deployed a fix on 8 January 2020, adding X-Content-Type-Options: nosniff and X-Frame-Options: DENY. The report was disclosed on 21 January.

The image server could reach internal services

The resizer accepted an image URL and fetched it server-side. We could use that request to scan internal ports and collect service banners. If an internal image’s URL was known, the endpoint could also retrieve it.

The access was limited to HTTP requests; it did not provide arbitrary local-file access or access over every network protocol.

Report and resolution

Anh submitted report #707014 on 3 October 2019. LINE resolved the finding and awarded $1,350. The report became public on 2 August 2020.

Embedded content persisted the payload

A reflected-XSS issue could become stored XSS through the forum’s embedding flow. A malicious URL preserved in a post or profile could expose visitors when they viewed that content.

One component, multiple affected forums

Invision fixed the issue in version 4.4.9.1, released on 20 December 2019, and credited René Kroka for the Gfycat OEmbed report.

PUBG and Evernote also disclosed the effect on their forums, naming the same fixed version. Their reports became public on 2 and 3 January 2020. These disclosures followed the same component vulnerability across its installations.

GraphQL accepted the wrong object type

We found that a snippet-deletion mutation accepted a DiffNote identifier. The deletion service then followed that object’s repository relationship, allowing a user with Maintainer permissions to delete more than the intended snippet. GitLab assigned CVE-2020-13317.

A separate annotation-deletion path accepted a Project identifier from a user with Developer permissions. That report became CVE-2020-13341. GitLab awarded $4,000 and $5,000 for the two findings respectively.

Package uploads bypassed validation

In the Conan package API, crafted parameters could register a server-side file as package content. This produced limited file disclosure, tracked as CVE-2020-13298.

Nested multipart upload metadata provided another route around upload protections, tracked as the High-severity CVE-2020-13356. In the Maven API, differences in encoded-path handling between Workhorse and Rails allowed an access-control bypass, tracked as CVE-2020-15525.

Import responses exposed object existence

A group-import endpoint returned different responses depending on whether an object existed. We used those differences to determine existence without obtaining the object’s contents. GitLab assigned CVE-2020-13268.

A deploy key reached a restricted repository

A public project could still restrict its repository to members. We demonstrated that a deploy key associated with another project could clone that restricted repository. GitLab tracked the access-control issue as CVE-2020-13303.

Setup, tags, links and exports

The first four reports covered stored XSS in setup names and tag autocomplete, tabnabbing through a newly opened tab, and formula injection in CSV exports. Passbolt fixed the first three in version 2.11.

The CSV finding remained unfixed. Passbolt classified it as “Won’t Fix,” citing the user interaction and spreadsheet behavior involved.

Autofill suggestions on the wrong domain

The fifth finding involved credential suggestions appearing for an incorrect domain. Exploitation required two explicit user actions.

René reported the issue on 17 November 2019. Passbolt shipped a fix in version 2.11.2 on 21 November and published its disclosure on 26 November.

Accepted as a file, executed as HTML

In the first investigation, filename validation and file-signature checks accepted content that could later be interpreted as HTML. The application served the upload from its own domain.

Internet Explorer and the pre-Chromium version of Edge could interpret that content as HTML instead of keeping it in the expected image context. The finding depended on the validator, the response and the browser’s handling of it.

Following an upload into document review

In the second investigation, an identity-verification upload kept an attacker-controlled file extension but used a hashed filename that prevented direct retrieval. We used an HTML callback to trace where it went.

The callback showed the file being opened from a local Downloads folder. That revealed how uploaded documents reached a reviewer’s machine. The test used HTML; we did not upload malware or demonstrate a reverse shell.

The original articles

Jose published the two write-ups in May and September 2019. Both describe unnamed private programs.