Shaping RoomsBring a question

Research disclosure · Restricted

Public existence. Bounded detail.

Vendors, framework projects, CERT/CC, and OWASP were notified. Public and restricted material remain explicitly separated.

An open preparation desk beside a closed evidence cabinet whose restricted contents are absent.

Why this matters

Proving a risk does not require publishing a ready-made way to abuse it.

The public record explains what was found, why it matters, and who was notified. The architecture-specific material that could make exploitation easier remains restricted.

Restricted · v1.0

The restricted artifact is not in this public build.

Architecture-specific susceptibility profiles, platform-layer injection findings, compound attack hypotheses, and the full minimal vector series.

The public record establishes the research boundary without publishing operational bytes or implying access. Notification occurred on 2026-03-23.

Request access · security@shapingrooms.com