Vili vil

Unmasking the Calendar: Booksalon GraphQL API Chaining and Its Implications for OSINT

When we think of vulnerabilities, our minds immediately go to Remote Code Execution (RCE), SQL injections dumping passwords, or exposed credit card databases. But in the modern web ecosystem, some of the most fascinating vulnerabilities don't leak highly classified secrets. They leak context.

On April 14 2026, after getting a haircut at my local barber, I received an email asking me to review the service. Out of curiosity, I began investigating the traffic and API requests behind the review process. This led to the discovery of a chain of vulnerabilities in the GraphQL API of Booksalon, a popular salon booking platform. By combining broken access control, pagination abuse, and over-fetching, an unauthenticated attacker could completely deanonymize a salon's calendar.

While the leake

The Based Way to Install Apps on GrapheneOS

Got GrapheneOS on your daily driver and wondering how to actually get apps without compromising your privacy? This guide drops the absolute safest, most based, and the chaddest way to install your apps.

GrapheneOS App Store

Why GrapheneOS Is the Most Secure Android OS

GrapheneOS is a security- and privacy-focused mobile operating system built on Android. It runs on Google Pixel hardware and reinforces Android’s security model at every level. As the developers explain, GrapheneOS "starts from the strong baseline of the Android Open Source Project (AOSP) and takes great care to avoid increasing attack surface or hurting the strong security model." In practice, this means every feature is scrutinized for risk: unused hardware is disabled by default, new capabilities are opt-in, and aggressive exploit mitigations are added throughout the OS. The result is an Android variant that sacrifices little usability, but greatly strengthens defenses against both targeted and automated attacks.

Brave Browser Debloating Guide

Brave is an excellent, privacy-focused browser, but its default configuration comes packed with extra features that many users consider bloat. This guide will walk you through how to get rid of the bloat, hide the ads, and disable background services for a clean, minimal browsing experience.

Part 1: Clearing the Visual Bloat

The default start page and toolbars are crowded with Brave "cards," news feeds, and native crypto shortcuts. Fortunately, the surface-level clutter is easy to hide directly from the UI.

Clean the Start Page: Open a new tab, click the Customize button in the bottom right corner, and toggle off Brave News, Cards, and any unwanted background images or stats.
Clean the Toolbar: Right-click on the Brave Rewards, Brave Wallet, Brave VPN, and Leo AI icons located next to the URL bar, and select Hide.

Why Incognito Mode Isn’t Truly Private

Incognito or Private Browsing mode in web browsers is marketed as a way to browse more privately or anonymously. For example, Google Chrome’s help page says you can “browse the web more privately in Incognito mode,” and Firefox promises that Private Browsing “does not save your browsing information… and leaves no trace” on your device. Apple’s Safari explains that in Private Browsing it “won’t remember the pages you visit, your search history, or your AutoFill information,” and even

Operations Security (OpSec) Bible

Operations Security (OpSec) is crucial for maintaining the privacy and security of your activities. The following guidelines, divided into specific zones, will help you safeguard your identity and operations. Use common sense and conduct your own research to supplement these recommendations. Remember, these guidelines are meant for lawful purposes only.

These tips and tricks have been collected from other sources and guides that have been lost in time. Some of these tips

Install ClassPad Manager on Linux (with Wine)

This guide shows how to install ClassPad Manager Subscription for ClassPad II on Linux using Wine.

1) Download the Windows installer

Go to: https://edu.casio.com/softwarelicense/index.php
Download the ZIP file (it will look like cp2m_sub_2017001_2b.zip).

	#!/usr/bin/env bash
	# Simple Fonecta person/phone number lookup (scrapes the site JSON endpoint)
	# Usage: ./fonecta-lookup.sh "Mikko Mallikas" OR ./fonecta-lookup.sh "0401234567"
	# ./fonecta-lookup.sh -v "Mikko Mallikas" (verbose mode)
	# Made by Vili <https://vili.dev>

	set -euo pipefail

	VERBOSE=0

	debloat_brave() {
	echo "Creating policies..."
	sudo mkdir -p /etc/brave/policies/managed/
	local debloat_policies="/etc/brave/policies/managed/debloat.json"

	if [ ! -f "$debloat_policies" ]; then
	sudo touch "$debloat_policies"
	fi
	sudo tee -a "$debloat_policies" >/dev/null <<'EOF'
	{