http://blog.najdek.me/Recent content on Mateusz Najdek - blogHugo -- gohugo.ioen-usmateusz@najdek.me (Mateusz Najdek)mateusz@najdek.me (Mateusz Najdek)Sat, 13 Dec 5000 12:00:00 +0200http://blog.najdek.me/posts/responsible-disclosure-reflected-xss-sso/Sat, 30 May 2026 01:10:22 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/responsible-disclosure-reflected-xss-sso/Disclaimer: The vulnerability described below was discovered during independent security research. It has been responsibly disclosed to the institution’s IT department and was patched immediately. All sensitive details (target name, URLs) have been redacted to maintain confidentiality. Introduction Following up on my October 2025 discovery of a Path Traversal vulnerability in the Student Portal, I continued to keep an eye on the core infrastructure of the institution. Once you realize that legacy components exist in production, it is only logical to examine how the most critical gateways handle data.http://blog.najdek.me/posts/responsible-disclosure-path-traversal/Mon, 08 Dec 2025 01:16:36 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/responsible-disclosure-path-traversal/Disclaimer: The vulnerability described below was discovered during independent security research. It has been responsibly disclosed to the institution’s IT department and was patched immediately. All sensitive details (target name, URLs) have been redacted to maintain confidentiality. Introduction With a background in e-commerce engineering and system architecture, I have a habit of checking the “health” of the systems I interact with. During my first week of university, while browsing the Student Portal, my “security radar” went off.http://blog.najdek.me/posts/building-icup-custom-configurator/Sat, 15 Nov 2025 12:00:00 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/building-icup-custom-configurator/Context: In the world of personalized e-commerce on marketplaces like Allegro, the biggest bottleneck isn’t manufacturing—it’s matching the user’s design to the specific transaction without errors. Here is how I solved this problem with code. The Problem: “Which ‘Anna’ ordered this mug?” Selling custom products on Allegro (Poland’s largest marketplace) comes with a specific disconnect: the design tool lives outside the marketplace. Most competitors solve this lazily: after designing a mug, they ask the user to “Type your Allegro Nickname” in a form.http://blog.najdek.me/posts/ps5-lua-autoloader/Mon, 30 Jun 2025 12:00:00 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/ps5-lua-autoloader/Context: In the console security scene, a “Jailbreak” is rarely a single file. It’s usually a complex chain of vulnerabilities. When the PS5 Lua exploit (based on the Artemis game engine) was released, it was a raw developer tool: it opened a network port and waited for a PC to send code. This is fine for researchers, but terrible for usability. I engineered a full “Plug-and-Play” automation layer: an Autoloader that removes the PC dependency, and a graphical User Interface powered by an embedded HTTP server.http://blog.najdek.me/posts/building-custom-erp-native-php/Sat, 20 Jul 2024 14:00:00 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/building-custom-erp-native-php/Context: In the e-commerce world, the standard advice is “Don’t reinvent the wheel—use Shopify or BaseLinker.” I ignored that advice. I run a personalized manufacturing business (printing custom t-shirts and mugs) as a one-man operation. When you are working alone, you don’t need “enterprise features”—you need a force multiplier. Here is how I built “Monmat Manager,” a proprietary ERP that allows me to process hundreds of orders solo. The “Buy vs.http://blog.najdek.me/posts/carbon-for-f1tv-realtime-sync/Sat, 06 Apr 2024 10:00:00 +0200mateusz@najdek.me (Mateusz Najdek)http://blog.najdek.me/posts/carbon-for-f1tv-realtime-sync/Context: F1TV is the official streaming service for Formula 1. While the content is great, the web player lacked a crucial feature for data nerds: Multi-View (watching the Main Feed + Driver Tracker + Onboard Cameras simultaneously). Existing third-party tools relied on extracting stream URLs for external players, but this approach broke when F1TV implemented Widevine DRM. I engineered a solution that respects these security constraints while delivering a synchronized “Command Center” experience directly in the browser.