Positive Security Add us as a preferred source on Google
🔄 Data last refreshed 2 months ago
🤝
Make a deal with Positive Security
🔒 Paid proposals held safely in escrow — released only when the work's approved.
Followers
223
Account age
1 yrs
💰 Suggested sponsorship rate
$40 – $65 / sponsored post
Estimated from audience size & typical reach — every deal is negotiable and held in SocialDB escrow.
🎁 Free analysisfor Positive Security
Known for
538 views
At #38c3, we presented our #BlinkenCity research, which started as a fun art project idea, and ended up as a plausible European #blackout scenario.
https://www.youtube.com/watch?v=DAf-T3bFJFs
Details: https://positive.security/blog/blinkencity-38c3
TL;DR: Some European countries use unencrypted and unauthenticated #longwave radio to steer parts of their renewable power, enough to potentially cause
7 views
The latest @make magazine features an article of ours on "DIY #AirTags".
It contains:
- Brief explanation of the Find My protocol
- Introduction of @seemoolab's OpenHaystack
- Summary of our research (Send My & Find You)
- Example use cases for such (enhanced) DIY trackers
3 views
Our article on DIY AirTags is now also available in German! Zu finden im @MakeMagazinDE (1/2023) und @mac_and_i (2/2023)
📊 Post engagement
Recent posts · likes + reposts
Jan 7latest
80
Avg engagement / post
2–7
Typical post (engagement)
35.9%
Engagement vs followers
0/100
Spiky reach
Jan 2025
On Mastodon since
Half of recent posts land between 2 and 7 likes + reposts (median 3) — reach is spiky, driven by the occasional post that pops.
🔥 Top post: At #38c3, we presented our #BlinkenCity research, which started · 538 likes + reposts
📊 Activity & format
Posting cadence
0.14 / week
A lower-frequency account — each post lands with more weight.
Content mix
Mostly text
Recent: 9 text · 2 image · 1 video.
Recent posts
View on Mastodon ↗▶
🔥 Top post
At #38c3, we presented our #BlinkenCity research, which started as a fun art project idea, and ended up as a plausible European #blackout scenario.
https://www.youtube.com/watch?v=DAf-T3bFJFs
Details: https://positive.security/blog/blinkencity-38c3
TL;DR: Some European countries…
We found our bank's AI agents to be vulnerable to indirect prompt injection and XSS.
An attacker can craft malicious invoice PDFs or send transactions with malicious references to trigger the XSS in the AI agent, resulting in a full compro…
Vulnerabilities in the hidden magic of Lodash, Ramda and Underscore
We looked at the internals of JavaScript/TypeScript's most popular utility libraries and found interesting issues.
The post contains hacking challenges/live demos.
We reco…
We leverage indirect prompt injection to trick Auto-GPT (GPT-4) into executing arbitrary code and discovered vulnerabilities that allow escaping its sandboxed execution environment.
https://positive.security/blog/auto-gpt-rce
The Auto-GPT …
Our article on DIY AirTags is now also available in German! Zu finden im @MakeMagazinDE (1/2023) und @mac_and_i (2/2023)
Fabian was interviewed (in German) by Deutschlandfunk about the new tracking protection standard by Google and Apple (featuring a "backdoor" near-owner bit)
https://www.deutschlandfunk.de/zwielichtig-die-licht-und-schattenseiten-von-blueto…
The popular Ruby library "Ransack" can be abused to exfiltrate sensitive data via character by character brute-force.
We compromised multiple applications this way and found hundreds more that could be vulnerable.
https://positive.security…
The latest @make magazine features an article of ours on "DIY #AirTags".
It contains:
- Brief explanation of the Find My protocol
- Introduction of @seemoolab's OpenHaystack
- Summary of our research (Send My & Find You)
- Example use case…
urlscan.io leaks API keys, shared documents, password reset links, team invites, and other sensitive data.
We identified one culprit to be other security tools that accidentally make their scans public and put their users at risk.
https://…
An unpatched vulnerability in the popular dompdf PHP library allows for remote code execution via a malicious font+PHP polyglot file.
https://positive.security/blog/dompdf-rce
The exploit files and demo application are available here:
http…
We built a stealth AirTag clone that is not detected by Apple’s tracking protection. It works by only sending one beacon per generated public key.
https://positive.security/blog/find-you
The source code for the ESP32 firmware and macOS ret…
We present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved)
https://positive.security/blog/video-depixelation
Our article on DIY AirTags is now also available in German! Zu finden im @MakeMagazinDE (1/2023) und @mac_and_i (2/2023)
Fabian was interviewed (in German) by Deutschlandfunk about the new tracking protection standard by Google and Apple (featuring a "backdoor" near-owner bit)
https://www.deutschlandfunk.de/zwielichtig-die-licht-und-schattenseiten-von-blueto…
The popular Ruby library "Ransack" can be abused to exfiltrate sensitive data via character by character brute-force.
We compromised multiple applications this way and found hundreds more that could be vulnerable.
https://positive.security…
The latest @make magazine features an article of ours on "DIY #AirTags".
It contains:
- Brief explanation of the Find My protocol
- Introduction of @seemoolab's OpenHaystack
- Summary of our research (Send My & Find You)
- Example use case…
urlscan.io leaks API keys, shared documents, password reset links, team invites, and other sensitive data.
We identified one culprit to be other security tools that accidentally make their scans public and put their users at risk.
https://…
An unpatched vulnerability in the popular dompdf PHP library allows for remote code execution via a malicious font+PHP polyglot file.
https://positive.security/blog/dompdf-rce
The exploit files and demo application are available here:
http…
We built a stealth AirTag clone that is not detected by Apple’s tracking protection. It works by only sending one beacon per generated public key.
https://positive.security/blog/find-you
The source code for the ESP32 firmware and macOS ret…
We present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved)
https://positive.security/blog/video-depixelation
🐘 Community & instance
Home server
infosec.exchange
A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.
On Mastodon since
Jan 2025
An established account with real history on the platform.
💡 Facts
🗓️Joined Mastodon in 2025 — 1 year ago.
👁️Averages 80 views per post.
📤Posts about 0.1× per week.
🕵️ Fake follower check
Estimated71/100
Good
Credibility score
92%
Real
Real audience
Low
Fake-follower risk
Medium
Data confidence
- Est. 92% real, active audience · Low fake-follower risk.
- Strong engagement (~0.4× of followers engage each post) — an active, real audience.
Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.
About
Holistic IT Security Research & Consulting
📸 Gallery
🔀 Audience overlap
EstimatedEstimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.
Crash Server
17%
Stefan Lindecke #FckAfD
16%
Martin Dragosits
15%
Alte VHS
14%
Michael Perry
11%
Rainer
10%
More like this
Find more →
Mastodon
＋
Rainer
@herberg@mastodon.online
223
Followers
Mastodon
＋
Michael Perry ✓
@mpmilestogo@cupoftea.social
223
Followers
Mastodon
＋
Crash Server
@crashserver@mamot.fr
223
Followers
Mastodon
＋
Stefan Lindecke #FckAfD
@lindesbs@ruhr.social
223
Followers
Mastodon
＋
Alte VHS
@alte_vhs@bonn.social
223
Followers
Mastodon
＋
Martin Dragosits ✓
@mdragosi@literatur.social
223
Followers
Frequently asked questions
How much does Positive Security charge for a sponsorship?
Positive Security hasn't published fixed prices yet. Send a proposal through SocialDB and agree terms directly — your payment is held in escrow until the work is approved.
How do I contact Positive Security for a brand deal or collaboration?
Send a paid deal or collab request right here on SocialDB — we notify Positive Security, and once they accept, your payment is held safely in escrow and released when the work is approved. You don't need to track down an email.
How many followers does Positive Security have?
Positive Security has 223 followers on Mastodon.
✉ Message Positive Security
Reaching out to influencers is a Pro feature. Upgrade to message any influencer directly — perfect for brands and agencies booking sponsorships.
- ✓ Message any influencer from their listing
- ✓ The influencer gets notified by email
- ✓ Manage every conversation in one inbox
Already Pro? Log in.
🎤 Event / appearance with Positive Security
Booking an event / appearance is a Pro feature. Upgrade to book Positive Security for an in-person or virtual appearance — payment held safely in escrow until the event is done.
- ✓ Book them for events, livestreams, panels & more
- ✓ Positive Security gets notified by email
- ✓ Fee held in escrow, released after the appearance
Already Pro? Log in.
🚀
You're out of free requests this month
Free accounts get 5 per month. Go Pro for unlimited sponsor pitches, collab requests & sponsorship deals — plus featured placement, the Verified badge, free withdrawals and more.
Upgrade to Pro — $9.95/mo →Your free limit resets on the 1st of next month.
Auto-generated from Mastodon's public data — no affiliation with or endorsement by SocialDB. Is this you? Claim it · Remove