I exploit the trust your cloud placed in itself
And document what happens when vendors call them "working as intended"
Get an AssessmentCloud Security
Azure, GCP, AWS
Kubernetes
RBAC, Escape, Controllers
Identity
OAuth, OIDC, Federation
Disclosure
Responsible, Direct
Research covered by
Featured Research
Kingmaker: ASO Subscription Takeover
Namespace developer to Azure Subscription Owner in 60 seconds. Microsoft called the fix "a reasonable ask" in 2023. Still in the backlog.
TrustFall: ACK IAM Trust Policy Injection
Namespace developer to AWS account admin in 60 seconds. AWS said "file a GitHub issue." Five months later, still unpatched.
Think Different (About Bounds Checking)
1 byte of input, 7,799 bytes of heap leaked. Apple fixed both bugs but only credited one. My first CVE.
Cache Me Outside: Cross-Tenant Side-Channel
234 keystroke intervals extracted from unknown Azure co-tenants in 45 seconds. Microsoft called it "moderate." Then asked about Black Hat. Twice.
PrometheusUnbound: Cross-Namespace Secret Theft
Metrics exfiltration and cross-namespace secret theft in Google Managed Prometheus. PodMonitoring has validation. ClusterPodMonitoring doesn't.
ConfigConfusion: GCP IAM Takeover
Any Kubernetes namespace user can escalate to GCP Organization Owner. Google said "Nice catch!" then left it unpatched.
Azure Backup AKS Privilege Escalation
CERT/CC opened case VU#284781 and coordinated disclosure. Microsoft silently patched without CVE or customer notification.
Recent
Kingmaker: Microsoft Called This Fix 'A Reasonable Ask' — Three Years Ago
A CVSS 9.9 Azure Service Operator vulnerability lets any namespace user become Subscription Owner. GitHub Issue #3645 …
TrustFall: AWS ACK IAM Controller Lets Any Namespace User Own Your Entire AWS Account
TrustFall: A trust policy injection bug in AWS Controllers for Kubernetes grants namespace developers full AWS account …
Think Different (About Bounds Checking)
CVE-2026-84564: A logic bug in CGImageDestinationAddAuxiliaryDataInfo exposes uninitialized heap memory when auxiliary …