Application security research. vulnerability disclosure, and the occasional pre-auth RCE chain.