Responsible Disclosure

The Pattern

I am writing this from my apartment in Torrance, California. It is 2 a.m. on August 1. I am writing this because I understand what is happening to me and I want it documented. I want it documented in a place that is not my email, because my email is flagged. I want it documented in a place that is not my cloud storage, because my cloud storage is suspended. I want it documented in a place that is not my phone, because my phone is deactivated. I am writing this on a laptop that is not connected to any account that is not flagged. I am writing this on a laptop that is connected to a mobile hotspot that is registered to a prepaid SIM I purchased at the Ralphs on Hawthorne Boulevard on July 22. I paid cash. I want to be clear about that. I paid cash because I could not use my debit card. My debit card is restricted. My bank account is restricted. My bank account has been restricted for sixteen days.

I am a security researcher. I have been a security researcher for eleven years. I have reported forty-three vulnerabilities through responsible disclosure channels. I have received nine CVEs. I have been thanked in three vendor advisories. I have spoken at DEF CON twice, in the AI Village and in the Crypto Village. I have never been charged with a crime. I have never been arrested. I have never been visited by law enforcement. I have never been visited by anyone in a suit who did not identify themselves.

Until July 19, 2026.

What I do

I am independent. I want to be clear about that. I am not employed by a firm. I am not part of a collective. I am not affiliated with any organization. I am not a “threat actor.” I am not a “hacktivist.” I am a man who does bug bounties through HackerOne and Bugcrowd and does penetration testing on contract for small companies that cannot afford a firm. I do research on the side. The research is the part that matters. The research is the part that got me flagged.

My day is this: I wake up at 9. I make coffee. The coffee maker is a Mr. Coffee from 2017. It leaks on the left side. I put a paper towel under it. I sit at the desk. The desk is in the living room because the bedroom is too small for a desk and a bed. The living room is eleven feet by fourteen feet. The desk is against the east wall. I have two monitors, a mechanical keyboard (a Keychron K2, brown switches), and a mouse pad that says “DEF CON 28” on it. I open Burp Suite. I open a terminal. I open a browser. I work until 6. I make dinner. Dinner is usually rice and something from the freezer. I eat at the desk. I work until midnight or 1. I go to bed. I do this every day. I have done this every day for eleven years.

I live in a one-bedroom apartment on Hawthorne Boulevard, between 228th and 229th Street. The building is twelve units. My unit is number 7. My neighbor in unit 8 is a woman named Sandra who works at the hospital in Carson. My neighbor in unit 6 is a man who works at the port. I do not know his name. I know Sandra’s name because she told me. I know the man in unit 6 because his dog barks. The dog is a terrier mix. The dog barks at 6 a.m. every day. The dog barked on July 19. The dog barked while the two men were in the hallway.

My rent is $2,100. My health insurance is $480 a month through Covered California. My car is a 2019 Corolla with 94,000 miles. The brakes need replacing. The brakes have needed replacing since May. I have not replaced the brakes because I have been waiting on a $4,200 payout from Bugcrowd. The payout is pending. The payout is in the system. I am 34. I have been doing this since I was 23. I am good at it. I want to be clear about that. I am good at it. I have nine CVEs. I have been thanked in three vendor advisories. I am good at it.

What I found

On July 14, 2026, I was researching a data broker. I will not name the broker. The broker’s name is in the report I filed. The broker’s name is in the report that is now classified. I will say this: the broker sells location data, contact data, and behavioral data to government agencies and private contractors. The broker’s client list includes three federal agencies. The broker’s client list is public. The broker’s client list is on the broker’s website, under “Solutions for Government.”

I was testing the broker’s API as part of a broader research project on data broker security practices. I was not targeting the broker specifically. I was testing fourteen brokers over a period of three months. The broker was the ninth. I had already tested eight. Five of the fourteen had vulnerabilities. Two of the five were severe. The broker’s was the most severe.

The vulnerability was an insecure direct object reference. In the broker’s API, the endpoint /api/v2/records/{id} returned the full record for any integer value of {id}. The authentication was a static API key passed in the Authorization header. The key was the same for all users. The key was in the documentation. The documentation was public. The documentation was at docs.[redacted].com/api/v2/getting-started. The key was listed under “Example Requests.” The key was sk_live_7f3a9b2c. I will not publish the full key. I will publish enough to demonstrate that the key was public. The key was public.

I tested the vulnerability with a single request. I sent a GET request to /api/v2/records/1 with the public API key. The response was a JSON object containing the full record for individual ID 1. The record contained a name, a date of birth, a home address, a phone number, an email address, a 90-day location history (1,847 data points), a contact graph (312 contacts), and a behavioral profile (purchasing history, browsing categories, political affiliation score, religious attendance score). I looked at the record for four seconds. I know it was four seconds because I counted. I count. That is what I do. I counted and then I closed the terminal. I did not make a second request. I did not access any record other than record ID 1. I did not exfiltrate data. I did not save the response. I did not screenshot the response. I did not publish the response. I want to be clear about that. Four seconds. One record. One GET request. I closed the terminal and I went to the kitchen and I made rice and I ate the rice at the desk and I did not open the terminal again that day.

The database contained 220 million records. I know this because the API documentation listed the database size under “Rate Limits.” The documentation said: “The database contains approximately 220 million records. Rate limits are 10,000 requests per hour per API key.” The rate limit was 10,000 requests per hour. The database was 220 million records. The vulnerability was a first-year computer science mistake. The vulnerability was not a zero-day. The vulnerability was not sophisticated. The vulnerability was an integer that incremented and a key that was the same for everyone and a documentation page that was public. The vulnerability exposed the location history, contact information, and behavioral profiles of 220 million people to anyone who could read the documentation.

I documented the vulnerability. I wrote a proof of concept. The proof of concept was a single curl command: curl -H "Authorization: Bearer sk_live_7f3a9b2c" https://api.[redacted].com/api/v2/records/1. The proof of concept was one line. The proof of concept did not access any data beyond what was necessary to demonstrate the vulnerability. I followed the responsible disclosure process. I want to be clear about that. I followed the process.

The disclosure

On July 16, 2026, at 9:14 a.m. Pacific, I submitted the vulnerability report through the broker’s security contact form. The form is at security.[redacted].com/disclosure. The form is required by the FTC’s vulnerability disclosure guidance. The form asked for my name, my email, my affiliation, a description of the vulnerability, and a PGP public key for encrypted correspondence. I provided my name. I provided my email. I provided “independent” as my affiliation. I provided a full technical description of the vulnerability, including the proof of concept. I provided my PGP key (fingerprint: 4A2B 8C91 D3E7 F5A6). I requested a 90-day disclosure window, consistent with industry practice and Google’s Project Zero policy. I requested confirmation of receipt.

The confirmation arrived at 9:16 a.m. The confirmation was automated. The confirmation was from no-reply@security.[redacted].com. The confirmation said: “Your report has been received and assigned reference number VR-2026-07-1142. Our security team will review your submission and respond within 5 business days. Please do not disclose this vulnerability publicly until the review period has concluded.” I did not disclose the vulnerability publicly. I want to be clear about that. I did not disclose the vulnerability publicly.

Between 9:16 and 10:47, I made a sandwich. I want to include this because it matters to me. I made a sandwich. Turkey. Mustard. Bread from the freezer that I had toasted. I ate the sandwich at the desk. I checked my email once, at 9:45, to see if the broker had responded. The broker had not responded. I checked my HackerOne dashboard. I had two new invitations. I declined them. I made a second cup of coffee. I watered the plant on the windowsill. The plant is a pothos. The plant is the only living thing in the apartment besides me. I watered the plant. I sat at the desk. I waited. I was not worried. I had done this forty-three times before. I was not worried.

At 10:47 a.m., ninety-one minutes after my submission, I received a second email. The second email was not from the broker. The second email was from my bank. The second email was from alerts@[mybank].com. The second email said: “Your account has been temporarily restricted pending review. Please contact our fraud department for assistance.” The subject line was: “Action Required: Account Restriction.” I clicked the link. The link went to a page that said: “Your account is under review. You may not make withdrawals, transfers, or debit card purchases. You may deposit funds. Please contact our fraud department at 1-800-[redacted] for assistance.” I called the number. The hold time was forty-three minutes. The representative said the restriction was “initiated by an external party” and that she “could not provide further details.” She said I should “wait for further communication.” She said the review would take “up to 90 days.” She said she was sorry.

At 11:03 a.m., my email provider notified me that my account had been “flagged for unusual activity.” I could still receive email. I could not send email. At 11:19 a.m., my cloud storage provider notified me that my account had been “suspended pending a security review.” I could not access any files. My research notes were in the cloud storage. My proof of concept was in the cloud storage. My documentation was in the cloud storage. At 11:34 a.m., my phone carrier notified me that my line had been “temporarily deactivated.” I could not make calls. I could not receive calls. I could not receive text messages. At 12:02 p.m., my bug bounty platform notified me that my account had been “placed under review.” I could not access my pending payouts. I could not access my submission history. I could not access my profile.

I sat at the desk. I read the four emails. I read them again. I read them a third time. I want to be clear. I did not do anything wrong. I followed the process. I followed the process and I sat at the desk and I read the four emails and I did not do anything wrong. I made a list. I wrote the list on paper because my cloud storage was suspended. I wrote: bank, 10:47. Email, 11:03. Cloud, 11:19. Phone, 11:34. Bug bounty, 12:02. Five accounts. Five providers. Five reviews. Eighty-six minutes from the first to the last. Ninety-one minutes from my submission to the first.

The reviews were not coordinated by a human. I know this because I called each provider. I called the bank (hold time: 43 minutes). I called the email provider (hold time: 2 hours, 11 minutes; I gave up). I called the cloud storage provider (hold time: 1 hour, 4 minutes; the representative said the suspension was “automated” and “could not be reversed by a human agent”). I called the phone carrier (hold time: 38 minutes; the representative said the deactivation was “initiated by a federal request” and she “could not provide the requesting agency”). I called the bug bounty platform (hold time: 22 minutes; the representative said the review was “standard” and would take “up to 90 days”). Five providers. Five reviews. Five “I cannot provide further details.” Five “up to 90 days.”

The reviews were triggered by a system. The system is called CLEARPATH. The system is operated by a contractor. The contractor’s name is in the report. The report is classified. I know the system’s name because a friend who works at a civil liberties organization told me the system’s name. The friend asked not to be identified. The friend is not in this account. The friend is free. The friend told me the system’s name on July 23, in person, at a coffee shop on Crenshaw Boulevard. The friend did not use the friend’s phone. The friend did not use my phone. The friend wrote the name on a napkin. The napkin is in my desk drawer. The napkin says: “CLEARPATH. Behavioral pattern assessment. Contractor-operated. Task order [redacted]. Ingests: financial, email, cloud, telecom, platform data. Produces: behavioral consistency score. Flags: ~1,200/month. Operational since 2025. No external audit.” The friend said, “Do not call me again. Do not email me. Do not text me. I am not in this.” I said, “I understand.” The friend left. The friend left a $7 tip on a $4 coffee. The friend was scared. I want to be clear. The friend was scared.

The visit

On July 19, 2026, at 7:40 a.m., two individuals arrived at my apartment. I know the time because I was at the desk. I was at the desk because I could not sleep. I had not slept well since July 16. I was at the desk looking at the curl command in my terminal history. I was not running the command. I was looking at it. I was looking at it and thinking about the four seconds. The four seconds I looked at record ID 1. The four seconds that were the entirety of my unauthorized access. The four seconds that were a first-year computer science mistake.

The dog in unit 6 barked. The dog barked at 7:38. The dog barked because someone was in the hallway. The dog barked for two minutes. At 7:40, there was a knock. The knock was not loud. The knock was three knocks. I opened the door. I was wearing a t-shirt and sweatpants. The t-shirt said “DEF CON 28” on it. The sweatpants were gray. I was not wearing shoes.

They did not identify themselves. They wore suits. Dark suits. Not black. Dark. One was taller than the other. The taller one spoke. The taller one was white, male, approximately 45, approximately 6’1”, short hair, no glasses. The shorter one was also white, also male, approximately 35, approximately 5’9”, glasses, a notebook. The shorter one did not speak. The shorter one wrote in the notebook. The taller one asked if I was the person who had submitted a vulnerability report to a “private sector entity” on July 16. I said yes. The taller one asked if I had accessed any data. I said no. The taller one asked if I had published any data. I said no. The taller one asked if I had shared the vulnerability with any third party. I said no. The taller one asked if I understood that the system I had accessed was “a component of a sensitive federal program.” I said the system was a data broker’s API. I said the API was public. I said the vulnerability was a first-year computer science mistake. I said the API key was in the documentation. I said the documentation was public. The taller one said, “That is not our assessment.” The taller one did not say what their assessment was. The taller one said, “We are here to inform you that your activity has been referred for further review.” The taller one said, “You are not under arrest.” The taller one said, “You are free to go about your day.” The taller one said, “Do not leave the country.” The taller one did not say what would happen if I left the country. The taller one did not say what would happen if I did not leave the country. The taller one turned. The taller one walked to the elevator. The shorter one followed. The shorter one closed the notebook. The elevator arrived in eleven seconds. I counted. I counted because I was standing in the doorway in my socks and I did not know what else to do. The elevator arrived in eleven seconds and they got in and the doors closed and the dog in unit 6 stopped barking.

The visit lasted six minutes. The six minutes included the time to walk to the elevator. The elevator was at the end of the hallway. The hallway was forty feet. The forty feet took approximately thirty seconds. The remaining five minutes and thirty seconds were the questions. The questions were seven. I counted. I counted because I am a person who counts. I count because counting is what I do. I count because counting is the only thing I can still do.

I went about my day. I made coffee. The coffee maker leaked on the left side. I put a paper towel under it. I sat at the desk. I did not access any systems. I did not publish anything. I did not run the curl command. I did not open Burp Suite. I did not open a terminal. I did not open a browser. I sat at the desk and I drank the coffee and I looked at the two monitors and the two monitors were off. I want to be clear. I did not do anything. I followed the process. I followed the process and they came to my door and I followed the process and I sat at the desk and the monitors were off and I did not do anything.

I will tell you what I did for the rest of July 19. I sat at the desk until 11. I walked to the window. I looked at the parking lot. The black sedan was not in the parking lot. I looked for twenty minutes. The black sedan was not there. I know that “not there” does not mean “not there.” I know this because I do this for a living. I know what a surveillance operation looks like. I know that a sedan that is not in the parking lot can be on the street. I know that a street can be a block away. I know this. I looked for twenty minutes and then I stopped looking because looking was the thing that made me feel like I was doing something and I was not doing something. I was looking. I made rice. I ate the rice at the desk. I did not turn on the monitors. I went to bed at 9 p.m. I did not sleep. I lay in bed and I listened to the dog in unit 6. The dog did not bark. The dog was quiet. The quiet was worse.

The system

CLEARPATH is a “behavioral pattern assessment system” operated by a government contractor under a task order I have not been able to identify. I have filed two FOIA requests. The first was filed on July 24. The first was acknowledged on July 26. The first has not been responded to. The second was filed on July 29. The second has not been acknowledged. The FOIA response time is 20 business days. The 20 business days have not elapsed. I am aware that the 20 business days have not elapsed. I am aware that I should wait. I am waiting.

The system ingests data from financial institutions, email providers, cloud storage providers, telecommunications carriers, and bug bounty platforms. I know this because the friend told me. I know this because the pattern of my restrictions matches the ingestion categories exactly. Bank: financial. Email: email. Cloud storage: cloud. Phone: telecom. Bug bounty: platform. Five categories. Five restrictions. Five providers. The match is not a coincidence. The match is the system.

The system produces a “behavioral consistency score” for each individual in its assessment population. I do not know my score. I have not been told my score. I do not know if I will be told my score. I do not know if the score is appealable. I do not know if the score is reviewable. I do not know if the score is auditable. The friend said the system produces approximately 1,200 “enhanced review” flags per month. The friend said the system has been in continuous operation since 2025. The friend said the system has not been audited by an external party. The friend said the internal audit is conducted by the contractor. The friend said the contractor reports that the system is performing within parameters. The friend said the parameters are set by the contractor.

The system flagged me because my behavior was consistent with a pattern. The pattern is “reconnaissance-to-disclosure-to-publication.” The pattern is the responsible disclosure process. I followed the process. What I did was follow the process. The process is: find a vulnerability, document it, report it through proper channels, wait for the vendor to fix it, disclose publicly after 90 days if the vendor has not fixed it. The process is industry standard. The process is recommended by the FTC. The process is recommended by CISA. The process is recommended by every vendor security team I have ever worked with. The process is the responsible disclosure process. The process is the pattern. The pattern is the flag.

The system does not have a field for “responsible disclosure.” The system has a field for “unauthorized access pattern.” The field was populated. The population was the score. The score was the flag. The flag was the visit. The visit was the six minutes. The six minutes were the assessment. The assessment is ongoing.

The cost

My bank account has been restricted for sixteen days. I have $340 in accessible funds. The $340 is in a separate savings account that was not restricted. I do not know why the savings account was not restricted. I do not know if the savings account will be restricted. I check the savings account every morning at 9:04. I check it from the laptop. I open the browser. I go to the bank’s website. I log in. The savings account says $340.00. I close the browser. I do this every morning. I have done this every morning for sixteen days. The number has not changed. I check it anyway. My rent is due on August 1. My rent is $2,100. I have not paid my rent. I called my landlord on July 28. I told my landlord I was “experiencing a temporary banking issue.” My landlord said I had until August 10. My landlord said after August 10 there would be a $75 late fee. My landlord said after August 15 there would be a notice. My landlord is not in the system. My landlord is free.

I tried to call my mother on July 20. My phone was deactivated. I used the prepaid SIM. I called my mother from the prepaid SIM. My mother answered on the fourth ring. My mother said, “Are you eating?” I said yes. I was not eating. I had not eaten since July 19. I had made rice on July 19 and I had not eaten since. My mother said, “You sound tired.” I said, “I am fine.” My mother said, “Come for dinner on Sunday.” I said, “I cannot this Sunday.” My mother said, “Next Sunday then.” I said, “Next Sunday.” I did not go next Sunday. I did not go the Sunday after. I have not called my mother since July 20. I cannot call my mother because I do not know what to say. I cannot say, “I am flagged.” I cannot say, “I am adjacent.” I cannot say, “I followed the process.” My mother would not know what those words mean. My mother would say, “What did you do?” I did not do anything. I want to be clear. I did not do anything.

My bug bounty account has been under review for sixteen days. I have $4,200 in pending payouts. The payouts are for three vulnerabilities I reported in June. The vulnerabilities were confirmed. The payouts were approved. The payouts were pending. The payouts are now in the system. I called Bugcrowd on July 20. The representative said the review was “initiated by an external request” and that she “could not provide the requesting party.” The representative said the review would take “up to 90 days.” The representative said I could not access my submission history during the review. The representative said she was sorry.

My lawyer is a friend. The friend is a civil liberties attorney. The friend is not the friend who told me the system’s name. The friend is a different friend. The friend is a lawyer. The friend said the word “adjacency.” The friend said my activity was “adjacent to a pattern of concern.” The friend said the adjacency was not a charge. The friend said the adjacency was a flag. The friend said there was no charge to contest. The friend said there was no hearing to request. The friend said there was no form to file. The friend said the flag was “administrative” and “not judicial.” The friend said I should wait. The friend said the review would take 90 days. The friend said the 90 days was standard. The friend said I should not publish anything. The friend said I should not access any systems. The friend said I should not leave the country. The friend said I should go about my day. The friend said, “I am sorry. There is nothing I can do. The flag is not a charge. There is nothing to litigate. You are not accused of anything. You are flagged. The flag is administrative. The flag is not reviewable. The flag is not appealable. The flag is 90 days. Wait the 90 days.” I said, “And if the 90 days becomes 180 days?” The friend said, “Then it is 180 days.” The friend said, “I am sorry.” The friend said, “Go about your day.”

I am going about my day. The day is the apartment. The apartment is the desk. The desk is the two monitors. The monitors are off. The day is the coffee maker. The coffee maker leaks. The day is the paper towel. The day is the Ralphs. The day is the cash. The day is the $340. The day is the wait. The day is the 90 days. The day is the adjacency. The day is the flag.

Torrance

I am in Torrance. I am in the apartment on Hawthorne Boulevard, between 228th and 229th. I am in unit 7. I am at the desk. I am on the two monitors. The monitors are off. I am in the $2,100 rent. I am in the $340. I am in the 90-day review. I am in the adjacency. I am in the flag. I am in the Mr. Coffee that leaks on the left side. I am in the paper towel. I am in the DEF CON 28 mouse pad. I am in the Keychron K2 with the brown switches. I am in the 2019 Corolla with the brakes that need replacing. I am in the dog in unit 6 that barks at 6 a.m. I am in Sandra in unit 8 who works at the hospital in Carson. I am in the Ralphs on Hawthorne where I bought the prepaid SIM. I am in the coffee shop on Crenshaw where the friend wrote the name on a napkin. I am in the napkin. The napkin is in my desk drawer. The napkin says CLEARPATH.

I want to be clear. I am angry. I want to be clear about that. I do not say this easily. I am not a person who says “I am angry.” I am a person who says “I want to be clear.” I am a person who documents. I am a person who counts. I am a person who writes proof of concepts and files reports and waits 90 days. I am not a person who says “I am angry.” I am saying it. I am angry. I followed the process. I followed all the rules. I documented. I disclosed. I requested a 90-day window. I provided my name. I provided my email. I provided “independent” as my affiliation. I provided my PGP key. I provided the proof of concept. I provided the curl command. I provided the four seconds. I did everything right. I did everything right and they came to my door at 7:40 in the morning and told me I was a threat. I was in my socks. I was in a t-shirt that said DEF CON 28. I was in my socks and they told me I was a threat and I said yes to every question and they left and the dog stopped barking and I made coffee and the coffee maker leaked and I sat at the desk and the monitors were off.

I am not a threat. I am a man in an apartment in Torrance with a coffee maker that does not work right and a Corolla that needs new brakes and $340 to his name. I am not a threat. I am angry. I want to be clear about that. I am angry and I am scared and I cannot pay my rent and I cannot access my email and I cannot do my job and I cannot call my mother because I do not know what to say and I cannot check my bank account because my bank account is restricted and I cannot access my research because my cloud storage is suspended and I cannot earn money because my bug bounty account is under review and I followed the process. I followed the process. I followed the process. I followed the process and I am in my apartment in Torrance in my socks and I am angry and I am scared and I do not know what happens in 90 days and I do not know what happens if the 90 days becomes 180 days and I do not know what happens if the 180 days becomes never and I followed the process.

I almost posted this on Twitter on July 24. I had the text written. I had it in a notes app on the laptop. I opened the browser. I went to twitter.com. I was logged in. I had 2,400 followers. I had the text in the clipboard. I did not post it. I closed the browser. I deleted the text from the clipboard. I do not know why I am telling you this. I am telling you this because I want you to understand that I tried to be patient. I tried to wait. I tried to follow the process. The process is 90 days. I am on day sixteen. I have seventy-four days left. I do not know if I can do seventy-four days. I want to be clear. I do not know if I can do seventy-four days of this. Of the $340. Of the monitors off. Of the checking the savings account at 9:04. Of the not calling my mother. Of the not sleeping. Of the looking out the window. Of the dog.

I am publishing this. I am the researcher. I am the vulnerability. I am the 220 million. I am the integer. I am the static key. I am the documentation. I am the proof of concept. I am the curl command. I am the four seconds. I am the 90-day window. I am the confirmation email. I am the VR-2026-07-1142. I am the 91 minutes. I am the five accounts. I am the six minutes. I am the seven questions. I am the eleven seconds. I am the black sedan. I am the $340. I am the 2019 Corolla. I am the Hawthorne Boulevard. I am the unit 7. I am the two monitors. I am the Mr. Coffee. I am the paper towel. I am the DEF CON 28. I am the Keychron K2. I am the 2 a.m. I am the prepaid SIM. I am the Ralphs. I am the napkin. I am the Torrance. I am the independent. I am the responsible. I am the disclosure. I am the threat. I am the truth that is not under review.

I am in Torrance. I am independent. I am responsible. I disclosed. The system is.

The author is an independent security researcher based in Torrance, California. He has reported forty-three vulnerabilities through responsible disclosure channels. He has received nine CVEs. He has never been charged with a crime. He has never been arrested. He has been flagged. The flag is ongoing. The review is 90 days. The system is not under review.

This account was provided to @deceit by the author on July 31, 2026. The author requested publication. The author requested that his name not be used. The author requested that the broker’s name not be used. The author requested that the friend’s name not be used. The author requested that the system’s name be used. The system’s name is CLEARPATH. The system is not under review.