Healthtech & medical devices
5 client organizations
// CLIENT PORTFOLIO · Since 2026
Client Portfolio & Findings
A sanitized view of 20 client organizations across web, mobile, medical, embedded and regulated systems. Findings are counted per occurrence: repeated vulnerability classes on different assets, endpoints or workflows remain separate. Secrets and operational details are omitted.
14
Critical
27
High
17
Medium
19
Low
2
Informational
// CLIENT COVERAGE · 2025-2026
Client sectors
20+ organizations
Energy, EV charging & monitoring
2 client organizations
Industrial IoT & embedded systems
2 client organizations
Electronic security & access control
2 client organizations
Web, API & enterprise software
5 client organizations
Identity, AD & cybersecurity
1 client organization
Telecom & public sector
1 client organization
Payment & transaction systems
1 client organization
IT infrastructure & information systems
1 client organization
// ANONYMIZED CLIENT INDEX
Client portfolio
20 client aliases · 2025-2026
Client A
2026Healthtech & medical devices
35 distinct findings
2 public write-ups
Client B
2025-2026Healthtech & medical devices
12 distinct findings
3 public write-ups
Client C
2026Energy, EV charging & monitoring
35 distinct findings
2 public write-ups
Client D
2025Healthtech & medical devices
3 distinct findings
1 public write-up
Client E
2025Industrial IoT & embedded systems
2 distinct findings
1 public write-up
Client F
2025Healthtech & medical devices
Findings non publiés
0 public write-ups
Client G
2025Web, API & enterprise software
Findings non publiés
0 public write-ups
Client H
2025Healthtech & medical devices
Findings non publiés
0 public write-ups
Client I
2025Telecom & public sector
Findings non publiés
0 public write-ups
Client J
2025Electronic security & access control
Findings non publiés
0 public write-ups
Client K
2025Electronic security & access control
Findings non publiés
0 public write-ups
Client L
2025Web, API & enterprise software
Findings non publiés
0 public write-ups
Client M
2025Identity, AD & cybersecurity
1 distinct finding
1 public write-up
Client N
2025IT infrastructure & information systems
Findings non publiés
0 public write-ups
Client O
2025Industrial IoT & embedded systems
Findings non publiés
0 public write-ups
Client P
2025Payment & transaction systems
Findings non publiés
0 public write-ups
Client Q
2025Web, API & enterprise software
3 distinct findings
1 public write-up
Client R
2025Web, API & enterprise software
2 distinct findings
2 public write-ups
Client S
2025Energy, EV charging & monitoring
Findings non publiés
0 public write-ups
Client T
2025Web, API & enterprise software
Findings non publiés
0 public write-ups
// 2025 FINDINGS
First-year findings
14 findings · 6 engagements
Client B · 20253 findings · 2 write-ups
Healthtech & medical devices
Medical imaging workstation, DICOM services and licensing workflow.
- → Unauthenticated DICOM service exposed a parser denial of service through deeply nested sequences.
- → Kiosk escape, weak local privilege boundaries and unsigned safety parameters created a device-compromise chain.
Client D · 20253 findings · 1 write-up
Healthtech & medical devices
Regulated web application and file-import workflow.
- → SVG upload validation bypass enabled stored client-side script execution.
- → Unauthenticated API information exposure and export workflow weaknesses increased data-leak risk.
Client E · 20252 findings · 1 write-up
Industrial IoT & embedded systems
ARM gateway, boot chain and exposed debug interfaces.
- → Unsigned boot configuration remained outside the verified-boot boundary.
- → An exposed UART console allowed a physical attacker to reach a privileged recovery path.
Client M · 20251 finding · 1 write-up
Identity, AD & cybersecurity
Active Directory delegation and privileged-object security review.
- → Excessive permissions on AdminSDHolder created a persistence and domain-administration escalation path.
Client Q · 20253 findings · 1 write-up
Web, API & enterprise software
Web application, upload processing and XML parsing surface.
- → Recursive XML entity expansion caused resource exhaustion and repeated server errors.
- → Permissive cross-origin policy and verbose error responses increased information exposure.
Client R · 20252 findings · 2 write-ups
Web, API & enterprise software
Angular business application, document uploads and account workflows.
- → Stored XSS through upload filtering bypass could reach authenticated users and sessions.
- → Broken access control exposed account impersonation and document-download paths.
// ENGAGEMENTS
Five attack surfaces
79 findings · sanitized for public disclosure
28 Aug - 04 Sep 202618 findings · 1 critical · 2 high · 2 medium · 12 low · 1 info
Client A - Mobile, API & public web
Mobile application, Firebase, HR backend and public web surface.
- → Embedded secrets chained into Firebase access, HR backend exposure and account takeover.
- → Unauthenticated REST proxy and missing login rate limiting.
- → PII exposure, exposed diagnostics and weak mobile resilience controls.
09 - 11 Sep 202617 findings · 5 critical · 5 high · 3 medium · 4 low
Client A - HR extranet & backend
Authenticated extranet and HR backend authorization model.
- → Cross-domain IDOR/BOLA exposed user, employee and document records at scale.
- → Authentication secrets were returned in clear JSON responses.
- → Unauthorized document deletion, upload impersonation and missing MFA on SSO admin access.
August 20269 findings · 6 medium · 3 low
Client B - Medical ultrasound platform
Ultrasound workstation, kiosk boundary, licensing and compiled application code.
- → Kiosk escape reached Windows Explorer and a shell from a physical authenticated session.
- → Boost token deserialization occurred before signature verification.
- → Compiled code, development paths and weak admin protection increased reverse-engineering risk.
202617 findings · 6 critical · 10 high · 1 medium
Client C - Connected charging station
Connected charging station assessed against EN 18031-1:2024.
- → Unsigned firmware and engineering-grade Android configuration enabled arbitrary firmware installation.
- → Persistent storage exposed credentials, keys, badges and operational history.
- → Weak authentication, cleartext channels and exposed remote services expanded the attack surface.
202618 findings · 2 critical · 10 high · 5 medium · 1 info
Client C - Embedded charging station
Embedded charging station, dashboard, TLV protocol and debug interfaces.
- → Privileged TLV commands were accepted without authentication.
- → Open JTAG/SBW and missing secure boot enabled firmware dump and reprogramming.
- → Predictable credentials, replayable RFID frames, cleartext HTTP and stored XSS weakened the control plane.
Detailed reports are available on request under the relevant disclosure agreement. Public write-ups contain only sanitized technical lessons and reproducible defensive context.