Security research
Parser analyses software for security vulnerabilities, reports them to vendors through coordinated disclosure, and documents the results here.
An online booking system does not fully enforce the capacity of a time slot. As a result, an already fully booked slot can be booked again without authentication (overbooking). Reported via Patchstack, where the same issue had already been reported earlier (duplicate). Technical details will follow once a fix is available.
Our approach
We report every vulnerability to the vendor first, set a clear deadline, and publish technical details only once users are protected.
Vendors learn of a vulnerability first. Technical details appear only once a fix is available.
Every finding has a status, a timeline and — where available — a CVE identifier.
We cover our work through vendors’ bug-bounty rewards. We do not take on assessment work for others and do not sell vulnerabilities.
We disclose vulnerabilities responsibly and are happy to hear from you.
