About
I am David Vieira-Kurz, a senior security researcher who has worked in vulnerability research full time since 2007, with a focus on web and application security.
Until 2020 I was active as @secalert on X/Twitter and still use the handle as a personal pseudonym. Since then I publicly maintain only this blog and my GitHub profile at github.com/secalert, where my full CVE/GHSA list also lives.
My current work centres on secure code review and vulnerability research in enterprise and open-source software. The goal is always to document findings reproducibly and to report them to the respective maintainer and security teams through responsible disclosure.
About this blog
window.name is my personal security-research blog. The opinions here are my own, not those of my employer. Some of the articles are revised versions from the early years of my research (2011-2016, originally on secalert.net). Their technical substance is unchanged, while the tone and examples have been adapted for a professional blog. A few historical images no longer exist and have been removed.
Contact
- GitHub: github.com/secalert
- For security-relevant reports, please use security.txt