Skip to content
devwallssecurity
A city seen at night from above, lit windows across the dark
work

engagements, written up in full

Everything here is published with the client's written consent, and every client read the page before it went live. Names are withheld where the finding is still exploitable elsewhere.

published
3 of 480
consent
Written, per engagement
embargo
Minimum 6 months
DW-2601
Transport / OT
2026
An empty railway platform at night under overhead lighting

reached the signalling network from a ticket kiosk

A payment terminal on a station concourse turned out to share a VLAN with the operational network four hops away.

4
hops from kiosk to signalling VLAN
0
alerts raised during initial access
31
detection rules written afterwards
DW-2518
Financial services
2025
A cable-stayed bridge lit across water at night

a tenancy bug that let one merchant read another's settlements

Authorisation was enforced at the gateway and assumed everywhere behind it. One internal endpoint had never been given the memo.

1
endpoint missing a tenancy check
2.1m
settlement records reachable
6h
from report to patch in production
DW-2507
Healthcare
2025
A long clinical corridor receding under cold overhead light

forty-one roles that could reach patient data. three should have.

Nobody had built a privileged path deliberately. Six years of small, reasonable IAM decisions had built eleven of them.

41
roles with a path to patient records
11
distinct privilege escalation chains
94%
of standing access removed

why so few are published

Most of what we find belongs to the client, and a good number of the findings are still live in other estates running the same software. We publish an engagement when the client agrees, the issue is fixed, and the write-up teaches something that is not already common knowledge. That is a high bar, and it is meant to be.

A dense city skyline at night, lit windows in red and amber

tell us what you would least like us to reach

Scoping is a conversation with the people who own the systems, not a form. Twenty minutes is usually enough to tell whether we are the right practice for the problem.

Start scoping a test