Independent data protection and security engineering.
A practice that does two things most organisations have to hire separately: the data-protection law and the security engineering. Twenty years of UK privacy implementation — DPIAs, ROPAs, breach response — alongside cryptographic design and vulnerability research with fixes shipped in macOS and OpenBSD. Every engagement is scoped in writing and delivered as written work.
Each area maps to published output: papers, disclosed findings, accepted patches, methodology documents. The work is on the record, which means you can judge it before you commission it.
The implicit contract between researcher and vendor. What happens, structurally, when timelines are honoured in form but disengaged in substance.
Key management, smart-card and NFC authentication, payment-system architecture. Lineage includes the NHS Approved Cryptographic Algorithms standard (co-author, 2004) and the TfL Oyster contactless design.
Darwin / XNU on macOS; OpenBSD network daemons. Source-level audit paired with binary verification against shipping artefacts. Two CVEs credited by Apple in September 2026.
EV2First mutual authentication, AES-128-CMAC verification, Secure Dynamic Messaging. The first native open-source NTAG 424 DNA SDK for macOS.
UK GDPR, DPA 2018, and the Data (Use and Access) Act 2025. DPIAs, LIAs, ROPAs, transfer impact assessments. Twenty-plus years of implementation experience.
How a small practice verifies its claims. Empirical-verification gates between hypothesis and submission. The discipline of declining to file until binary, disassembly and live behaviour agree.
The discipline is the asset; the findings are the receipts.
Reverse chronological. Entries link to the full public document where one is published.
A missing zero-length guard in the kernel NFS server’s readdirplus path, and unenforced MS-SMB2 copy-chunk limits in smbd. Both addressed with improved input validation. A third report is acknowledged under Terminal in the iOS 27 and macOS Golden Gate 27 advisories.
A four-class taxonomy, a pre-send filter, and two real disclosure withdrawals from the practice's own OpenBSD work. The honest case for routine pre-send discipline, from the sender's end.
Thirteen years latent. The body was parsed as chunked but a co-present Content-Length header was not stripped before forwarding, contrary to RFC 9112 §6.1. Found by a targeted source-review pass against the framing rules.
Five commits landed in −current following a corrected per-claim disclosure. The resolution side of the case study at the centre of The Calculator Discipline.
Five-stage pipeline: recon, verify, disclose, harness, orchestrator. Walked-back experiments ship alongside survivors with per-tool post-mortems.
Path pruning, spectral anomaly, SSA dataflow, symbolic taint, on-device validation — used across the 2026 OpenBSD disclosure batch.
Unified runtime trace pipeline for XPC daemons in the PAC era, where static call graphs no longer suffice.
Pre-authentication, network-reachable. A length-prefixed binary parser failed to validate the inner length before trusting it.
A worked example of the gap between source undefined behaviour and live exploitability: the stock arm64 build does not crash, owing to the project's stack-protector posture.
A bounds-check omission, a missing copy-chunk limit, and unsigned client-controlled parameters on icloud.com — the last published 34 months after first report.
Six-phase methodology distilled from thirty-five years of structured practice. Eleven chapters on disclosure, the Darwin/XNU landscape, and working with vendor security teams.
Sourced from NIST SP publications. Written for a national programme protecting sixty million patient records.
A small research practice depends on being clear about what it knows, what it does not, and how it tells the difference.
The shipping artefact is what runs. Source is intent. Divergence between the two is treated as material until proven otherwise, and the running binary is disassembled before any claim of a live finding.
Every disclosure carries a working reproducer, a tested version, the vendor reference, and an explicit list of what has and has not been verified. Speculative filings waste vendor time and researcher credibility.
The pre-filing adversarial review, the binary-versus-source protocol, and the disclosure-timing calculus are published in full. Critique is welcomed; improvements are integrated.
TriageForge was founded in 2026 by Stuart Paul Thomas in Whitby, North Yorkshire. Thirty-five years of professional practice spanning payment terminals; the Sony PlayStation 2 UK launch network; the NHS Approved Cryptographic Algorithms standard; the Transport for London Oyster contactless payment system; and macOS and OpenBSD vulnerability research published in 2026.
The practice is, at the time of writing, a single-researcher operation. Growth is anticipated through collaboration with researchers in adjacent fields, rather than through employment or capital. The institutional framing — practice, lab, we — describes how the work is structured, not headcount.
Researchers active in cryptographic infrastructure, coordinated disclosure, kernel-level research, NFC and smart-card security, privacy implementation, or small-lab methodology are invited to make contact regarding specific collaborations. Co-authorship and credited contributions follow standard academic practice.
Two disciplines that normally have to be bought separately: the law that governs personal data, and the engineering that actually protects it.
The named or supporting DPO role for organisations that need it without the headcount. DPIAs, LIAs, ROPAs, vendor schedules, retention, breach response, staff training.
UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Gap assessments, transfer impact assessments, subject-access handling, and policy that survives contact with a regulator.
Key management, smart-card and NFC authentication, payment-system architecture. The discipline behind the TfL contactless key design and the NHS algorithms standard, applied at the scale you actually have.
Source-level audit paired with binary verification against the artefact you ship. Findings arrive with a working reproducer and an explicit list of what has and has not been verified.
Running coordinated disclosure with a vendor, or receiving it well. Triage, evidence discipline, timeline management, and the judgement to decline to file when the evidence does not hold.
Analysis for legal, regulatory or insurance contexts, written to be read by people who will test it. Plain English, with the reasoning and the uncertainty both on the page.
Engagements run in writing. Scope, deliverable and timescale are agreed by email before anything starts, and the result arrives as a document you can hand to an auditor, a regulator or an engineer — not a meeting you have to take notes in. Rates depend on scope and are quoted up front.
Community groups, charities and small research teams: a limited amount of pro bono work continues alongside the paid work. Say so in your first email.
Written enquiries welcome. Outline the problem, the timescale you are working to, and any constraint you already know about.
contact@triageforge.co.ukTriageForge takes paid engagements in data protection and security, and a limited amount of pro bono work for community, charity and research organisations. It does not take retainers, investment, or work that depends on a conflict of interest being overlooked.
contact@triageforge.co.uk
privacy@triageforge.co.uk
security@triageforge.co.uk