Skip to content
Classy Methods

Security research

Authorized research. Reproducible evidence. Responsible disclosure.

Classy Methods investigates how real systems enforce trust — and where they do not. Work is conducted under published disclosure programs or explicit permission, tested with the smallest experiment that answers the question, and reported privately to the organization that can fix it.

Capabilities

Where we focus.

The emphasis is on the logic of an application rather than on volume scanning: the places where identity, permission and workflow assumptions meet.

  • 01

    Attack surface discovery

    Authorized reconnaissance that maps what an organization actually exposes — hosts, services, applications and third-party dependencies — strictly within the published scope.

  • 02

    Web application and API analysis

    Manual and tool-assisted review of request flows, API contracts and client behavior to find where implementation departs from intent.

  • 03

    Authentication and authorization boundaries

    Testing whether identity, session and permission checks hold at every boundary — including object-level access, role transitions and multi-tenant separation.

  • 04

    Business-logic research

    Flaws that scanners do not see: workflows that can be reordered, skipped or combined to produce outcomes the system was never meant to allow.

  • 05

    AI-assisted hypothesis generation

    Language models help propose and prioritize hypotheses from observed behavior. Every hypothesis is reviewed, and every test is chosen and run under human direction.

  • 06

    Controlled testing and evidence

    Minimal, non-destructive experiments with timestamps, requests and responses preserved so each conclusion can be reproduced and checked.

  • 07

    Responsible disclosure

    Findings are reported privately through the organization's own disclosure channel, written for the people who need to fix them, and not published without permission.

  • Out of scope by design: denial-of-service testing, social engineering, physical intrusion and any activity outside a program's published rules.

Methodology

Hypotheses, experiments, evidence.

Every investigation follows the same loop. Scope is established first and checked continuously; disclosure is the only step that leaves the boundary.

Research loop: observe, hypothesize, test and record evidence inside the authorized scope; disclosure is the only step that leaves it.01 · SCOPE — AUTHORIZED BOUNDARY02Observe03Hypothesize04Test05Evidenceevery step recorded06Disclose
The research loop used for every engagement.

  1. 01

    Scope

    Confirm authorization, rules of engagement and exclusions before any traffic is sent.

  2. 02

    Observe

    Map the surface passively first, then with low-impact, in-scope requests.

  3. 03

    Hypothesize

    State a specific, falsifiable expectation about how a control could fail.

  4. 04

    Test

    Run the smallest experiment that can confirm or reject the hypothesis.

  5. 05

    Evidence

    Preserve requests, responses and timing; note what was not tested.

  6. 06

    Disclose

    Report clearly through the proper channel and support remediation.

Research tooling

Internally developed research tooling.

Research is supported by proprietary, internally developed Python tooling built to keep investigations structured, scoped and auditable. It is used for Classy Methods' own research and is not offered as a commercial product.

In use today

Current

  • Campaign scope controls

    Targets, exclusions and rules of engagement are defined per campaign and checked before activity runs.

  • Structured reconnaissance

    Discovery results are recorded as structured data rather than loose notes, so they can be compared over time.

  • Hypotheses and experiments

    Each hypothesis is linked to the experiments that tested it and to their outcome — including negative results.

  • Evidence preservation

    Requests, responses and observations are retained with timestamps alongside the hypothesis they relate to.

  • Investigation reports

    Reports are assembled from the recorded evidence, keeping the reasoning chain traceable.

Research direction

Not operational

  • Greater AI-driven autonomy

    Research into letting models plan and sequence in-scope experiments with less step-by-step direction.

  • Human checkpoints retained

    Any future autonomy is being designed around scope enforcement and human approval, not around unattended exploitation.

Autonomous vulnerability discovery and exploitation are not operational. The items above describe research direction, not current capability.

Rules of engagement

Conduct is part of the method.

Authorized only
Research is conducted under published vulnerability disclosure policies or explicit written permission, and stops at the edge of scope.
Reproducible
Each report states the exact conditions, steps and evidence needed for a vendor to reproduce the behavior independently.
Minimal impact
No denial-of-service testing, no data exfiltration beyond what proves the issue, and no persistence on third-party systems.
Measured claims
Severity is the vendor's call. Reports describe what was observed and what it could plausibly enable — nothing more.

Disclosure record

Vulnerability disclosure experience.

Submissions through public vulnerability disclosure programs, listed with the outcome each organization actually recorded. Informational outcomes are shown as such.

  1. 01

    NASA

    Vulnerability Disclosure Program

    Letter of recognition

    Security research submitted through NASA's vulnerability disclosure program resulted in a NASA Letter of Recognition issued to the researcher.

  2. 02

    Microsoft

    Microsoft Security Response Center (MSRC)

    Report submitted

    An authorization-related vulnerability report was submitted to MSRC.

    Vendor assessment is not represented here as complete.

  3. 03

    U.S. Department of Defense

    Vulnerability Disclosure Program

    Triaged · informational

    A vulnerability disclosure submission was reviewed and triaged as informational.

    Not presented as a validated vulnerability.

  4. 04

    U.S. Department of Homeland Security

    Vulnerability disclosure via Bugcrowd

    Triaged · informational

    Security reports were submitted and classified as informational.

    Not counted as accepted vulnerabilities.

Disclosure records reflect research by an individual researcher associated with Classy Methods. They are not awards or engagements of the company, and no client relationship with any organization listed is implied.

Contact

Coordinating a disclosure?

If you operate a program and need to reach us about a submission, or would like to discuss authorized research, email is the most direct route.

Email contact@classymethods.com

Security reports: security@classymethods.com