https://research.triada.in Blog, whitepapers, and research from Team Triada: offensive and defensive security write-ups, CTF postmortems, and vulnerability research. en-IN Thu, 02 Jul 2026 00:00:00 GMT https://research.triada.in/client-side-secrets-in-modern-webapps https://research.triada.in/client-side-secrets-in-modern-webapps Thu, 02 Jul 2026 00:00:00 GMT How we found hardcoded signing keys and BaaS credentials in production JS bundles across two separate engagements, and how we triaged them. Adarsh SR methodology secrets spa supabase jwt https://research.triada.in/git-history-credential-hygiene https://research.triada.in/git-history-credential-hygiene Thu, 25 Jun 2026 00:00:00 GMT Why secret scanning limited to HEAD misses a whole class of long-lived exposure, and the sweep methodology we now run on every engagement. Adarsh SR research secrets git supply-chain https://research.triada.in/ssrf-via-wordpress-pingback https://research.triada.in/ssrf-via-wordpress-pingback Wed, 10 Jun 2026 00:00:00 GMT How we found and confirmed SSRF and brute-force amplification through a decade-old WordPress endpoint during a recent web assessment. Adarsh SR ssrf wordpress web