From Discovery to Disclosure by Ibad Shah

Ibad Shah walks through the practical journey of discovering critical vulnerabilities in modern web and mobile applications and shepherding them through the coordinated vulnerability disclosure (CVD) process. He shares firsthand experiences identifying severe architectural and authorization flaws in enterprise mobile applications.

Shah highlights the attack surface of fast-growing consumer mobile platforms at 00:58 and 03:04. He demonstrates finding Insecure Direct Object References (IDOR) and broken object-level authorization vulnerabilities at 05:05 and 07:54, allowing unauthorized account access by simply swapping identifier parameters. At 09:53 and 13:59, he shares practical strategies for locating responsible security contacts, overcoming unresponsive vendor support channels, and leveraging coordinated disclosure programs to ensure vulnerabilities are remediated without legal friction.

(AI summary — Gemini Flash)