Jonathan Dunn · XSS Doctor
Bypass Security is my home for independent security research—browser internals, AI systems, and the strange seams where software trusts too much.
One person, following interesting questions all the way down
Most of my work starts in client-side code and ends wherever the trust boundary breaks. The interesting part is understanding exactly why.
The subtle behavior between routers, windows, URL parsers, native bridges, and the code that assumes they are simpler than they are.
How prompt injection, browser gadgets, tool access, and application state combine into real attack paths around modern AI products.
Research systems that make repetitive checks cheap while keeping the creative work—forming and proving the right hypothesis—human.
I like bugs that teach me something about the system. The goal is to trace the behavior, prove the attack path, and explain the root cause clearly enough that someone else can see it too.
Start with behavior, data flow, and trust—not the expected architecture.
Follow small inconsistencies until they become an explainable primitive.
Turn the idea into bounded, reproducible evidence and a durable lesson.
Original writing, long-form conversations, and independent reviews of the work.
A conversation with Joseph Thacker about building Singularity, an AI-assisted system for bug bounty research.
OpenA technique for turning inconsistent prompt-injection exploitation into a repeatable client-side loop.
OpenA map of client-side path traversal primitives across eight major frontend frameworks and the sinks that make them matter.
OpenA hands-on walkthrough of client-side workflow, framework behavior, and real bug stories.
OpenThe story of building an AI-assisted bug bounty system, with the project narrative written by JD.
OpenA practical method for undoing array-shifting JavaScript obfuscation and recovering readable source.
OpenI’m a cardiologist, hacker, and the person behind XSS Doctor.
I came to security through curiosity and stayed for the moments when a strange behavior finally makes sense. Bypass Security is simply the home for that work: the research I publish, the tools I build, and the conversations I join.
Keep in touch
New research, tools, browser oddities, and the occasional good bug story.
@xssdoctor