Hey, I'm Vinoth
RSS FeedDirector of Engineering @ Refold AI. I build and scale infrastructure and security for AI products by day, and hunt bugs by night. Over the years my research has landed critical findings across Facebook, Microsoft and other platforms.
Read the write-ups below, or find me on LinkedIn.
Featured
DOMinator: a Chrome extension for hunting postMessage DOM XSS
DOMinator is now public on the Chrome Web Store. It records postMessage traffic, grades each listener's origin check, traces tainted values into sinks, and builds a replay and PoC from what it finds.
$20000 Facebook DOM XSS
This is the story of how I found $20000 Facebook DOM XSS.