Public research
These case studies preserve the reasoning: what was observed, which boundary was tested, and what impact was safely demonstrated.
Selected public record. Private program evidence stays private.
Source / path / proof
Responsible disclosure
How a mobile observation comment became stored XSS on a public NASA GLOBE web page, with verified impact, root cause, and remediation.
Research challenge
An unintended stored XSS path in Intigriti Challenge 0526 involving unsafe innerHTML, observed SCA Shield bypass behavior, and sink-side remediation.
Case study
How an accepted text file rendered as HTML became blind stored XSS inside an internal review workflow.
How the evidence is handled
Sensitive program details, customer information, credentials, and exploit material are never published. The useful lesson remains: the data flow, failed assumption, validation method, and remediation principle.
