Coordinated disclosure across regional financial, government, and critical-infrastructure systems. Findings are reported to vendors first and published only with remediation confirmed and written permission granted.
Most production systems are assembled under deadline pressure. Security gaps are the predictable result, not the exception. Independent research exists to find those gaps before adversaries do and to give the operators a chance to close them quietly.
Every engagement here follows coordinated vulnerability disclosure. No destructive testing. No data exfiltrated beyond what is needed to prove impact. No technical detail published until the affected organisation has remediated and granted written permission to be named.
The page below is what is safe to share now.
Every finding documented on this page was discovered under the following operating rules. They apply without exception.
Anonymised | No proof-of-concept
Regional
Chain demonstrating full-database extractability without valid credentials. Disclosed; partial fixes applied; core issues remain.
Multilateral
Special-category patient data exposed via a combination of web-server misconfiguration and an unauthenticated development endpoint. Partial remediation; residual exposure outstanding.
Multilateral
Misconfigured web server exposing deployment artefacts and sustained logging of customer data. Disclosure sent to vendor; awaiting acknowledgment and remediation.
Multi-campus
Multiple subsystems exposing student PII, a complete HR document archive, and evidence of an already-compromised learning-management system. Vendor acknowledged disclosure; detailed findings shared with assigned engineer for triage.
Multi-tenant
Banking-platform vendor shipping a hardcoded AES key in an unauthenticated response across a multi-bank fleet; hundreds of compromised customer sessions already visible in public infostealer telemetry. Disclosure sent to vendor; awaiting acknowledgment and remediation.
Multilateral
Public CMS media library used as a storage tier for exam-candidate identity documents; tens of thousands of records enumerable without authentication and duplicated on an unprotected development mirror. Disclosure acknowledged by asset owner; remediation in progress, regulator-escalation path remains pre-aligned with candidate-jurisdiction data-protection authorities.
Regional
A single unauthenticated API response on a regional food-delivery platform exposes the operator's production cloud credentials, payment-gateway test secrets, and a multi-tenant storage bucket with no per-tenant access scoping. Disclosure sent to operator and SaaS host; coordinated credential rotation and bucket-policy hardening pending alongside the upstream template patch.
Multi-tenant
Architectural defects in a SaaS delivery and ride-hailing platform template that ships to operators across the Americas, the Caribbean, MENA, and South Asia. Per-tenant credentials, payment-gateway secrets, and cross-tenant write capability are reachable without authentication on every operator deployment running the unpatched build. Disclosure sent to template vendor; upstream patch and coordinated rotation guidance pending.
Regional
Eastern Caribbean public-sector social-insurance host running a public web stack 11+ years past end-of-support. A source-control directory in webroot leaks production database credentials; the database super-user is reachable from the public internet; remote code execution is possible via this chain. Disclosure sent; the source-control-exposure primitive repeats a class previously observed at a separate regional social-insurance agency.
Vendor-first, evidence-based, no surprises.
Cards stay anonymised unless the affected party grants written permission to be named.
If you believe you have found a vulnerability in one of the systems KG3N Dynamics operates or publishes, our full coordinated-disclosure policy - including scope, safe-harbour terms, response SLAs, and reporting instructions - can be accessed here. A written acknowledgment is sent within 72 hours of any in-scope report.
The research above is performed independently. The same methodology is available as a commissioned engagement.