larisku
ID Discuss a project

SECURITY RESEARCH / CASE STUDIES

Evidence is more useful
than promises.

Security reviews and vulnerability research by EL1SYUM. Each case explains what was tested, what was found, the limits of the available evidence, and what it means for businesses and technical teams.

Explore the case studies ↓Discuss a security review ↗

01 / EL1SYUM SECURITY RESEARCH

Read the result.
Understand its limits.

External web security assessment / 10 October 2026

techindo.com

78 first-party HTTP requests covered the public web surface, search input, anonymous API access, and the admin login flow.

No impactful security finding or exploit chain was validated within the tested sample.

Scope
The agreed origin; an authorized, time-bounded external assessment.
Evidence confidence
Limited to the tested surface
Read the case study →
TECHINDO / ASSESSMENT PROCESS
  1. Authorized scope
  2. Public web surface
  3. HTTP observation
  4. Input / Auth / API checks
  5. Evidence review
  6. Validated finding?

NO HIGH-IMPACT FINDING VALIDATED

Limitations → no backend source, no comparison account, no owner-side database visibility.

02 / Personal research / redacted archive

September 2026 — exact date redacted

Historical API access research

The archive directly shows a client-side public anonymous-role configuration. Audit notes describe sensitive API reads, but raw admin and data responses are unavailable.

Scope: Three historical candidates in a private archive; target, provider, account, and credential values appear as ***.

Incomplete; impact not independently verified

Outcome

Authorization behavior and impact require owner-side verification; no write impact or account takeover is claimed.

Read the case →
03 / Authorization / historical publication

Archived 15 September 2026; test date not stated

Restricted token crosses a credential boundary

The archived publication describes a Restricted token that stayed limited on business resources but could read and revoke account-level credentials.

Scope: Researcher-owned account and disposable credentials; target, endpoints, tokens, and secrets: ***.

Validated according to the publication; raw artifacts absent from this backup

Outcome

The historical source states BOUNDARY_CROSSED, a tested secret, and owner-confirmed revocation. Cleanup restored the inventory baseline.

Read the case →
04 / Credential lifecycle / historical publication

Archived 15 September 2026; test date not stated

Descendant token survives delegation revocation

The source records a rejected source credential after revocation while its descendant still changed a nonsensitive marker verified by the owner.

Scope: A legitimate delegation and researcher-owned disposable objects/account; sensitive identities and artifacts: ***.

Validated according to the publication; raw artifacts absent from this backup

Outcome

The source states BOUNDARY_CROSSED. The marker was restored, the descendant was deleted and rejected, and inventory returned to baseline.

Read the case →
05 / Access control / historical publication

Archived 15 September 2026; test date not stated

Standard role changes project configuration

The publication records a standard role changing one project lifecycle attribute, confirmed by a separate server read.

Scope: A standard user on an authorized test project; program, endpoints, attribute names, and sensitive artifacts: ***.

Validated according to the publication; raw artifacts absent from this backup

Outcome

The publication states VALIDATED FINDING. Configuration was restored to baseline and read again to confirm recovery.

Read the case →

02 / READING THE EVIDENCE

A finding needs
more than an observation.

  1. Observation
  2. Reproduction
  3. Validation
  4. Impact confirmation
  5. Finding

A suspicious response starts an investigation. Reproduction and controls must establish the behavior, then an observable security effect must support the finding. Each detail page states where its evidence stops.

Explore the security review service ↗