010 research casefiles
Public sources
Advisories, source changes, and public records were analyzed. No behavioral reproduction is claimed.
Research assurance
Every claim stops where the evidence stops.
This page defines how jankesec publications handle review, validation, confidence, CVE ownership, AI assistance, and corrections.
54Published technical records
32Author reviews complete
22Source reviews complete
Evidence classes
Review is not validation.
Review says that a record was checked. Validation says how far the technical behavior was reproduced. The two axes are deliberately separate.
027 research casefiles
Static reproduction
The relevant code or patch behavior was reconstructed without executing a full exploit chain.
031 research casefiles
Lab reproduced
The stated behavior was reproduced in a controlled lab within the published claim boundary.
Two separate axes
Do not confuse editorial review with technical proof.
Who checked what?
Author review covers technical coherence; source review covers references and freshness. Neither label alone means lab reproduction.
What behavior was actually reproduced?
Only Research records claim Public Sources, Static Reproduction, or Lab Reproduced as an explicit validation level.
How strongly does the evidence support the conclusion?
Confidence describes evidence consistency. It does not inflate impact, exploitability, or vulnerability ownership.
Publication gate
Before a casefile is published.
- 01Authority and scope
Target-touching tests require written authority and explicit scope.
- 02Falsifiable claim
The conclusion must state what observation would disprove it.
- 03Positive evidence
A successful path is bound to identity, condition, decision, and effect.
- 04Negative control
A controlled counterexample shows why the same effect does not occur.
- 05Limits
Missing reproduction, environment dependence, and uncertainty are stated.
- 06Sources and freshness
Primary references and the latest review date are published.
Signature casefiles
A showcase of the standard, not the archive.
These five records were selected for evidence quality, negative controls, reusable method, and surface diversity—not recency or publishing volume.
01Technical publication
The Flow Is Standard. The Bypass Is in the Half You Skipped.
Reusable method, negative control, and a distinct system boundary.
02Technical publication
Android App Links: The Link Was Verified. The Action Was Not.
Reusable method, negative control, and a distinct system boundary.
03Technical publication
The Handshake Was Captured. The Network Was Not.
Reusable method, negative control, and a distinct system boundary.
04Technical publication
BloodHound Path Triage: The Shortest Path Is Usually the One That Expires First
Reusable method, negative control, and a distinct system boundary.
05Research casefile
CVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root
Root cause, patch boundary, and reproducible technical evidence.
Transparency
Tools may assist the work. They cannot become the evidence.
Artificial intelligence
AI may assist drafting, translation, code review, and hypothesis generation. It is never accepted as the sole technical source or finding evidence.
Visuals
Generated covers are editorial illustrations. They are not presented as screenshots, telemetry, or reproduction evidence.
CVE ownership
The CVE Showcase lists only coordinated disclosures credited to the author. Research may analyze CVEs discovered by other researchers.
Corrections
Material technical changes receive an updated date. Errors or disputes can be sent to [email protected].