LAB/05Research area
Vulnerability research: flaw classes and coordinated disclosure
Vulnerability research looks for classes of flaw, not single bugs, so that one finding improves how every later test is done. Anything found in third-party products is handled under coordinated disclosure.
- Area
- LAB/05 · Vulnerability Research
- Outputs
- Advisories released under coordinated disclosure, Research notes on flaw classes and how to test for them, Test cases and methods for offensive security and application security work, Static analysis rules and fuzzing harnesses, released as tools where useful, Talks on completed research
- Status
- Active research
01Open questions
What we are working on
Which classes of authorization flaw in multi-tenant applications and APIs are missed by scanners, and how can tests for them be made systematic?
How do weaknesses in widely used open-source components and their build pipelines propagate into the products that depend on them?
Which flaws recur in the gateways, remote access appliances and protocol converters that sit at the boundary between IT and OT networks?
How can variant analysis turn one confirmed finding into a search for the same pattern across a codebase?
What does a defender need from an advisory in order to act before a patch is available?
02Method
How the work is done.
- Code review and variant analysis
- Manual review is combined with query-based static analysis, using tools such as Semgrep and CodeQL, to describe a flaw pattern once and search for its variants.
- Fuzzing and dynamic analysis
- Parsers, protocol handlers and API surfaces are tested with coverage-guided and structure-aware fuzzing, with crashes triaged to root cause before anything is reported.
- Authorized targets only
- Research is carried out on software and hardware that Onion owns or licenses, in lab environments, or on targets whose owners have given written permission. Production systems belonging to others are never tested without authorization.
- Coordinated disclosure
- Findings go privately to the vendor or maintainer with reproduction detail. Publication follows a fix or an agreed timeline, with a CERT or coordinator involved where useful. Reports about Onion’s own systems are handled under the vulnerability disclosure policy.