Active Researcher
Vulnerability
Research & Security
Identifying and responsibly disclosing vulnerabilities in cryptographic systems, compilers, and public infrastructure.
Identifying and responsibly disclosing vulnerabilities in cryptographic systems, compilers, and public infrastructure.
Methodology for macOS vulnerability research — the BSD-to-XNU CVE cross-reference technique, the discipline of evidence and red-team review, vendor coordination under the 90-day standard. See the free Complete Framework book.
Smart card design, PKI architecture, key management, and cryptographic protocol analysis. Co-authored NHS national cryptographic standards (2004). Designed ActivCard contactless and TfL Oyster contactless ticketing infrastructure.
Large-scale network architecture. Designed PlayStation 2 network infrastructure for UK market. Resilience, scalability, secure connectivity.
Low-level vulnerability research in optimising compilers. Type coercion, unboxing, JIT-specific edge cases. V8, Turbofan, Maglev, SpiderMonkey.
Security analysis for NHS, TfL, financial institutions, and government networks. Scalability, resilience, regulatory compliance.
OWASP research, injection attacks, authentication bypass, supply chain security, and attack surface reduction.
ICMP crafting, DNS poisoning, tunnel protocols. Edge case exploration in RFC-compliant implementations.
UK GDPR, DPA 2018, emerging AI/ML privacy risks. Data subject rights, breach response, and algorithmic transparency. CIPP/E certified.
All research is conducted under strict responsible disclosure guidelines. Findings are reported directly to affected vendors with a coordination timeline of 90 days (or extended at vendor request). Public disclosure occurs only after vendor confirmation of patching.
For vendor programmes, I follow vendor-specific disclosure terms and CVE coordination processes.