Coordinated disclosure across regional financial, government, and critical-infrastructure systems. Findings are reported to vendors first and published only with remediation confirmed and written permission granted.
Most production systems are assembled under deadline pressure. Security gaps are the predictable result, not the exception. Independent research exists to find those gaps before adversaries do and to give the operators a chance to close them quietly.
Every engagement here follows coordinated vulnerability disclosure. No destructive testing. No data exfiltrated beyond what is needed to prove impact. No technical detail published until the affected organisation has remediated and granted written permission to be named.
The page below is what is safe to share now. As remediation lands and permissions clear, entries move from "Active" to the Hall of Fame and, where applicable, to full technical writeups.
Every finding documented on this page was discovered under the following operating rules. They apply without exception.
Anonymised while remediation or permission is pending. Severity and vulnerability class only - no organisation names, endpoints, or proof-of-concept material.
Regional
Chain demonstrating full-database extractability without valid credentials. Disclosed; partial fixes applied; core issues remain.
Multilateral
Special-category patient data exposed via a combination of web-server misconfiguration and an unauthenticated development endpoint. Partial remediation; residual exposure outstanding.
Multilateral
Misconfigured web server exposing deployment artefacts and sustained logging of customer data. Disclosure sent to vendor; awaiting acknowledgment and remediation.
Multi-campus
Multiple subsystems exposing student PII, a complete HR document archive, and evidence of an already-compromised learning-management system. Vendor acknowledged disclosure; detailed findings shared with assigned engineer for triage.
Multi-tenant
Banking-platform vendor shipping a hardcoded AES key in an unauthenticated response across a multi-bank fleet; hundreds of compromised customer sessions already visible in public infostealer telemetry. Disclosure sent to vendor; awaiting acknowledgment and remediation.
Organisation names, dates, and acknowledgment letters appear in the Hall of Fame below once remediation is confirmed and written permission is granted.
Published only after the affected organisation has remediated the issue and granted written permission to be acknowledged.
Long-form technical writeups of each disclosure, published once the vendor has confirmed remediation and approved the sanitised content.
Vendor-first, evidence-based, no surprises.
If you believe you have found a vulnerability in one of the systems KG3N Dynamics operates or publishes, our full coordinated-disclosure policy - including scope, safe-harbour terms, response SLAs, and reporting instructions - can be accessed here. A written acknowledgment is sent within 72 hours of any in-scope report.
The research above is performed independently. The same methodology is available as a commissioned engagement.