Software engineering / Security research
Classy Methods is an independent technology business. We build privacy-focused products for iPhone and Mac, and conduct authorized security research with documented methods, careful scope and responsible disclosure.
Independent vulnerability disclosure research. No affiliation or endorsement by the organizations shown is implied. Disclosure record details
Security research
Our research focuses on the boundaries where software makes trust decisions: who a user is, what they may access, and which workflows the system will allow. Every investigation runs inside an authorized scope and ends with evidence a vendor can reproduce.
Research methodology and disclosure recordRecognition
NASA · Letter of recognition
Issued to the researcher through NASA's Vulnerability Disclosure Program.
Manual and tool-assisted review of request flows, API contracts and client behavior to find where implementation departs from intent.
Testing whether identity, session and permission checks hold at every boundary — including object-level access, role transitions and multi-tenant separation.
Flaws that scanners do not see: workflows that can be reordered, skipped or combined to produce outcomes the system was never meant to allow.
Language models help propose and prioritize hypotheses from observed behavior. Every hypothesis is reviewed, and every test is chosen and run under human direction.
Products
Our products keep analysis on the device wherever possible and state their limitations plainly.
Privacy engineering · iPhone
An iPhone app that surfaces potentially unwanted trackers, smart glasses and other privacy-relevant wireless devices — and is explicit about what wireless detection cannot tell you.
Language learning · macOS
A native macOS menu bar utility for contextual translation. Point at a word, press a hotkey, and every lookup becomes a flashcard.
Entertainment · iPhone
A deliberately silly iOS app: drop your phone and it screams, with the drama scaled to the severity of the fall.
Method
Research is only useful if it is authorized, reproducible and proportionate. The same loop applies whether we are examining an API or evaluating our own products.
Research is conducted under published vulnerability disclosure policies or explicit written permission, and stops at the edge of scope.
Each report states the exact conditions, steps and evidence needed for a vendor to reproduce the behavior independently.
No denial-of-service testing, no data exfiltration beyond what proves the issue, and no persistence on third-party systems.
Severity is the vendor's call. Reports describe what was observed and what it could plausibly enable — nothing more.
Contact
For research coordination, disclosure correspondence, product questions or general business inquiries, email is the most direct route.
Security reports: security@classymethods.com
