Independent security research

Finding the quiet
failures in software
people trust.

I'm Abbas Hoseiny, an independent security researcher. Below are coordinated-disclosure case studies — each one a real vulnerability, reported through the proper channels, and written up honestly, scores included.

Case studies
imo Messenger — the link that reads you
A zero-click IP leak: receiving a URL makes your own device reveal your IP to the sender. 500M+ installs, reported via CISA/CERT-CC and BSI.
Case 01Zero-click IP leakCVSS 4.3 / 6.2Published
Olvid Messenger — WebRTC TURN injection
IP leak via injected TURN server, link-preview leak and configuration-link weaponization in an ANSSI-certified messenger.
Case 02In preparation
SKRED Messenger
Multiple findings, coordinated through BSI CERT-Bund and CERT/CC.
Case 03In preparation
About

Disclosure, done properly.

Every case here was reported to the vendor first and coordinated through national CERTs before publication. The write-ups favour defensible severity scores over dramatic ones, and document the full timeline — including the parts where no one replied.