Overview
SQUEMA performs authorized security testing and coordinated vulnerability disclosure for its clients and for organizations reached through good-faith outreach. This page records our public disclosure track record.
Technical details of any individual engagement are shared only with the affected organization and are never published without its written consent.
This disclosure record is maintained by Jordan Rivera (handle JordanRO2), founder of SQUEMA.
Track Record — 2026
- 20+ coordinated vulnerability disclosures to organizations across e-commerce, SaaS, online marketplaces, gaming, and fintech.
- Vulnerability classes identified and reported: account takeover, broken access control / IDOR, server-side request forgery, authentication and paywall bypass, PII and KYC exposure, exposed cloud credentials, and source-code disclosure.
- Findings reported through private bug bounty programs, HackerOne, and direct coordinated disclosure.
- Multiple high-severity findings acknowledged and rewarded by affected organizations.
Published Advisories & Credits
Entries are published by date as each affected organization consents to disclosure, and list only the organization, date, vulnerability class, and status. Additional coordinated disclosures are pending publication consent and will appear here as it is granted.
- Vket 2026 Summer — HIKKY Co., Ltd.— May 2026Coordinated security supportPublic credit — "Security Support" · reference
Methodology & Standards
Engagements follow established industry frameworks: OWASP, PTES, NIST CSF, and ISO 27001. We prioritize non-destructive, minimum-impact validation and restore any altered state at engagement close.
Reporting
To report a vulnerability or request coordinated disclosure, see our Responsible Disclosure Policy or contact security@squema.group.