Security issues in a Tor-based messenger
Cwtch credited my reports in its 1.17.2 security release. The fixes cover contact permissions and denial-of-service paths in several experimental features.
Noir0x63 / Security research
Eduardo
Camarillo
Application security researcher
I work in AppSec, investigating failures in authorization, business logic and applied cryptography through source review, adversarial modeling and targeted verification.
Research ↓01 / AppSec
Application-security assessments.
Application-security work is grouped here: public disclosures and authorized assessments, each tied to a reviewed system, evidence trail and remediation state.
Relay policy and claim-page exposure
The project names me for reporting an IPv4-mapped IPv6 policy bypass and a claim page exposed on the health listener. Both were addressed in v0.5.3.
Independent client security assessment
A source review of the public web client, shared cryptography package and Tauri shell. The project acknowledges the review and records its own remediation decisions.
GitHub OAuth callback trust boundary
The public advisory records the vulnerability and reporter credit for Noir0x63. It describes an unauthenticated server-side request flaw in the GitHub integration callback, followed by a corrective pull request and regression tests.
Binding payments to the right party
Reviewed settlement validation, merchant payment destinations and custody-key handling. Findings are linked to public advisories.
Authorization and module loading
Combined source review with isolated HTTP verification of RLS policies, server-side requests and the daemon's module boundary.
Who can join a conversation?
Reviewed participant authorization, Supabase row-level security and the encrypted-chat architecture. The selected findings include a policy that allowed an authenticated user to add themselves to another conversation, and a user-table read policy that exposed data beyond its intended boundary.
Rendered content and paid API limits
Source review and targeted verification found feed content reaching public pages without adequate escaping, allowing stored script execution, and proxy endpoints without sufficient limits on paid upstream API use.
Billing, reset and desktop boundaries
An independent source review identified plan-assignment RPCs without intended authorization checks, a password-reset flow insufficiently bound to reset context, and desktop distribution issues. Dynamic verification was outside the completed scope; the client remains anonymized.
02 / Further work
Research records.
Privacy protocol research
A research specification exploring asynchronous transport, private discovery and adversarial models. It is not presented as a production-ready protocol.
Protocol and implementation records
Dated work on key derivation, endpoint boundaries, application architecture and security review. These documents describe historical states.
Application trust boundaries
Six dated records cover the discussion platform's architecture, registration challenges, nonce and state validation, follow-up tests and hardening work. They document the reviewed versions and do not assert a current deployment state.
AppSec assessments
Source review and verification of authorization, business logic, and applied cryptography within an agreed scope. Deliverables include evidence, impact, remediation discussion, and retesting of agreed fixes. Scope, version, access, exclusions, and timeline are documented before work begins.
03 / Contact
Contact.
For authorized security assessments, research collaboration and responsible disclosure.
[email protected]