Vulnerability
research,
automated done
by hand.
the code.
LARP is a team of vulnerability researchers and bug hunters. We look for security bugs in software people rely on, report them to the vendor, and publish the details once they're fixed.
- published
- 10 write-ups, 8 advisories
- critical
- 3
- embargo
- 2 open, next lifts
From bug to write-up.
- 01
Read
We start by reading the code, the binary or the spec. Most of our bugs are found at this stage.
slow, but it works - 02
Fuzz
We write fuzzing harnesses for the parts that looked weak while we were reading.
lots of crashes, few real bugs - 03
Triage
Is the crash real, can an attacker reach it, and what can they actually do with it?
most crashes go nowhere - 04
Prove
A small proof of concept, enough for the vendor to reproduce the bug and fix it.
no weaponized exploits - 05
Disclose
We report to the vendor first and give them 90 days, or longer if they need it and keep us updated.
longest wait so far: 300 days - 06
Publish
Once it's fixed we publish a full write-up, including the approaches that didn't work.
so others can build on it
Latest write-ups.
- LARP-2026-014memorykazem0th
- LARP-2026-012webyuzu
- LARP-2026-011mobilesable
- LARP-2026-010cryptom0thampere
We go after hard targets.
Browsers, kernels, hypervisors, phones and the silicon under them. We find vulnerabilities in software and hardware that millions of people run, prove they are exploitable, and stay on them with the vendor until they are fixed.
browser and JavaScript engine exploitation Linux, Windows and hypervisor kernels Android and iOS, from apps down to baseband firmware, secure boot and fault injection web, cloud and identity infrastructure next target can't say yet
If you found something you want us to look at, or you're a vendor we contacted about a bug, email us. We reply to everything.
- general
hello@larp.example - reports
security@larp.example
PGP preferred- pgp
- 7F3A 92C1 0D4E 88B2 1C5F
9A0E 63D7 2B41 E9F8 0C17 - links
github x linkedin rss