Each case study keeps the data flow, failed assumption, validation method, and remediation principle needed to understand the issue.
Research & responsible disclosure
Findings, evidence, and lessons learned.
Published case studies from Garrett’s vulnerability research. Follow the issue, the confirmed impact, and the remediation lessons. Each case states its disclosure context.
Published case files
Responsible disclosure archiveNASA GLOBE Observer Stored XSS Case Study
How a mobile observation comment became stored XSS on a public NASA GLOBE web page, with verified impact, root cause, and remediation.
resolvedRead the case studyIntigriti 0526: Unintended Stored XSS Bypass
An unintended stored XSS path in Intigriti Challenge 0526 involving unsafe innerHTML, observed SCA Shield bypass behavior, and sink-side remediation.
publicRead the case studyBlind Stored XSS Through a Text File Upload
How an accepted text file rendered as HTML became blind stored XSS inside an internal review workflow.
publicRead the case studyHow the evidence is handled
What is published, and what stays private.
Case studies explain the security lesson while protecting private program evidence, customer data, and credentials.
Identifying details from private programs, customer records, session values, and credentials are omitted.