Who's LARP?
LARP started as a CTF team and moved on to real targets. Today we do vulnerability research on widely deployed software and hardware, and every finding goes through coordinated disclosure.
We're independent and we don't sell vulnerabilities. Everything we find goes to the vendor first, with a working proof of concept, and gets published once it's fixed.
Linux kernel and drivers, memory safety and race conditions.
Browser engines and JavaScript JITs.
Web applications, authentication flows and SSRF.
Android and iOS apps and their IPC surfaces.
Firmware, secure boot and fault injection.
We bring on researchers with a track record. Send your best write-up and what you want to work on next.
The team.
- 01kernel@kaze
Linux kernel and drivers, memory safety and race conditions.
open profile - 02browsers@m0th
Browser engines and JavaScript JITs.
open profile - 03web@yuzu
Web applications, authentication flows and SSRF.
open profile - 04mobile@sable
Android and iOS apps and their IPC surfaces.
open profile - 05hardware@ampere
Firmware, secure boot and fault injection.
open profile - 06open seatyou?
We bring on researchers with a track record. Send your best write-up and what you want to work on next.
join@larp.example
How we disclose.
1 The vendor hears about itfirst. 2 They get90 days to fix it, then we publish.3 We don't sell bugs toanyone. 4 Everyone who helped getscredited. 5 We write so a student can follow along.6 When we get something wrong, we say sopublicly. see LARP-2024-007