Threat Intelligence and Research
Start with vendor advisories, source commits, incident records, malware samples, and chain data, then preserve the links needed to check the conclusion.
About SOSEC
SOSEC publishes security investigations and browser tools. Reports begin with advisories, source code, incident material, or chain records; tools state where data is processed, whether a network request occurs, and what the output can establish.
Reports name their sources, versions, and revision dates. Tools explain what leaves the browser before the first input.
What We Do
Tools and Practical Capability
Put routine parsing, encoding, comparison, and first-pass triage in the browser, with the input, output, and limitations stated on the page.
Security Design with Clear Boundaries
Describe network access, logging, copy, and download behavior separately instead of covering every behavior with one privacy claim.
Design Principles
Local First
Browser tools parse the supplied material on the current device unless a page explicitly describes a separate request.
Minimal Logs
Application access logs keep the request path and omit pasted values, file bytes, and query values.
Explicit Boundaries
Every analysis page states whether it uploads, executes, resolves, or visits the material being examined.
Auditable and Reproducible
Reports cite the advisory, commit, transaction, sample, or protocol material used to reach each technical conclusion.
Research Method and Corrections
Source and Inference Stay Separate
We label direct source facts, source-grounded mechanism analysis, and hypotheses that still require local evidence.
Priority Is an Operational Judgment
SOSEC priority orders remediation by exposure, control-plane impact, exploit conditions, and evidence confidence; vendor severity is shown alongside it.
Visible Updates and Corrections
Articles show publication and update dates. Send factual corrections or source updates to [email protected] for review.
Observables Are Not Context Labels
Copyable observables remain separate from actors, products, victims, techniques, and controls so triage does not turn context into a blocklist.
Page and Environment Boundaries
Inside the Page Code
- Browser tools process selected files and pasted text in the current page.
- The application backend receives the page request, not the working input.
- Copy, download, and navigation occur after a user action.
- Tool pages describe any exception next to the affected control.
Outside the Page Code
- Following an external reference leaves sosec.io and uses that site's data policy.
- The operating system, browser extensions, input methods, and enterprise proxies can observe local activity.
- Open-source components and browser behavior change independently of this site.
- Production keys and live sessions still belong on a trusted device and browser profile.
Team and Contact
Research
Read our research and notes
Contact
Collaborate, send feedback, or report issues
Send factual corrections, additional sources, and tool issues to [email protected]. Article revisions retain an updated date.