Cesium is an independent group focused on security research, privacy advocacy, and open-source development. We document vulnerabilities under responsible disclosure, build useful tools, and help individuals reclaim their digital privacy.
We document vulnerabilities and run responsible disclosure research across platforms, services, and software. All findings are coordinated with vendors before publication under a 90-day disclosure window.
We build open-source tools, utilities, and applications that serve the security and privacy communities. Practical software that solves real problems — released under permissive licenses.
We provide clear, actionable information on online privacy, FOSS alternatives, and digital self-defense. No jargon — practical guides for individuals who want to take back control of their data.
Every vulnerability we find is reported to the affected vendor first. We give a minimum of 90 days for a fix before any public disclosure. Security research only improves the ecosystem when it's done with care — not for clout.
Cesium was founded by a small group of security researchers, developers, and privacy advocates who wanted to build something honest — a place to publish real research, ship useful tools, and help people understand the threats they face online.
A small, distributed group. Some of us prefer to stay pseudonymous — this is the security world, after all.
Web application security, tool development and responsible disclosure coordination. Has reported to a number of platforms under responsible disclosure.
All findings published here have been disclosed to vendors prior to publication. CVE IDs are linked where assigned.
A persistent cross-site scripting vulnerability in a widely-used project management tool's Markdown parser allowed injection of arbitrary JavaScript through image alt-text attributes. The issue affected all tiers including enterprise. Patched in version 4.12.1 following a 67-day disclosure window.
An analysis of OAuth 2.0 implementation patterns across 12 major SaaS platforms reveals a recurring pattern of session context leakage through referrer headers during the authorization code exchange flow. We document the pattern, affected configurations, and mitigations.
csm-scan is a lightweight, fast subdomain enumeration tool built for recon pipelines. Written in Go, it integrates with passive DNS sources, supports custom wordlists, and outputs clean JSON or plaintext. No telemetry. No rate-limit workarounds that violate ToS.
An insecure direct object reference in a patient record retrieval endpoint allowed authenticated users to access records belonging to other patients by incrementing a numeric ID parameter. Vendor notified. Currently within disclosure window — full advisory pending.
Practical, non-commercial guides on digital privacy, FOSS alternatives, and reclaiming control of your data. No affiliate links. No sponsored content.
Cloud-first software has become the default assumption. But for users who care about data sovereignty, local-first alternatives offer a compelling case — and the ecosystem has never been more mature. We survey the current state of local-first tools across productivity, communication, and notes.
Your DNS resolver sees every domain you visit. Most users are still using their ISP's default resolver, which logs and monetises that data. This guide walks through moving to an encrypted, private resolver — from DNS-over-HTTPS to running your own with Pi-hole and Unbound.
We intercepted and analysed the network traffic of 20 popular free Android applications over a 7-day period. The results — telemetry endpoints, fingerprinting payloads, and third-party SDK callbacks — are documented in full. Several apps contacted over 30 distinct tracking domains per session.
A curated, opinionated list of open-source alternatives for every major software category — with honest notes on where FOSS still falls short. No affiliate links, no referral codes. Just what we actually use and can vouch for.
Browser fingerprinting has grown more sophisticated, but so have the defences. We survey the current state of canvas fingerprinting, font enumeration, and WebGL probes — and assess what actually works to mitigate them in daily browsing.
Most people running a custom email domain have no authentication records configured — making their domain trivially spoofable. This guide explains SPF, DKIM, and DMARC in plain terms and walks through setting them up correctly, with common mistakes to avoid.