Bugs I found and fixed while building Sentinel, a passive web security scanner. Each writeup covers one real defect: what broke, why it mattered, and the actual before/after code.
Written by Edwin Lungatso, Nyxora Labs.
| # | Writeup | What it's about |
|---|---|---|
| 1 | The runtime gap that silenced a check | A property that exists in dev and not in production, and parsing certificate DER by hand to get it back |
| 2 | Grading the redirect instead of the page | The scanner followed redirects and graded the wrong response, confidently |
| 3 | DMARC at the wrong domain | Checking a subdomain for a record that is supposed to be inherited |
Code excerpts are pulled from Sentinel's source. Sentinel itself is closed source, so these are the specific lines the bug lived in, not full modules.