Below are a collection of the more interesting security investigations/issues I have worked on / discovered over the years (that have been made public) that did not scale out to be projects by themselves (like onionscan or evoting)
A malicious client could change the name `fileMetadata.name` attribute and when a client downloads the file it will happily use that name when deciding where to write the file i.e. if the name contains `../../` it will escape the `downloads` folder and write to any arbitrary directory.
This happened because the download file path is resolved to `${path.join(downloadDirectory, fileName)}`which allows path traversal because '/' chars in filename metadata is permitted.
File writes appeared to be completely unrestricted, and I wrote a simple PoC that escalates this to code execution (because an attacker can simply overwrite startup scripts, or shared libraries, or anything else).
(Note that even on platforms where writing outside of config is more difficult e.g. mobile, this vuln would be enough to likely cause deanonymization as config files / caches are clobber-able - and I suspect that ACE wouldn't be too difficult even in that restricted context)
This flaw was reported privately to Quiet team September 2023 and was patched within a week.
This flaw allowed any websites dropped into an Obsidian Canvas to add/delete/modify any file in the loaded vault. Creation of files is limited to .md files, but editing includes .canvas files. Because open and new URIs auto-open files in Obsidian this allows a single corrupted website to effectively chain spawn multiple malicious URI processes.
I recently disclosed several security and privacy vulnerabilities in Thunderbird. At worst these vulnerabilities can by exploited by an adversary with access to a collection of intercepted encrypted messages to trick Thunderbird into decrypting any given message and sending the resulting plaintext back to the adversary. This attack worked with Thunderbird default configuration, i.e. even when load remote resources are disabled
In 2017 I was contracted to conduct research into the security and privacy of connected toys for children.