Founder profile · Security research

Andrew J. Federico Jr.

Founder and Principal Architect, Azurite Solutions, LLC · Independent Security Researcher

Andrew is an enterprise solutions architect and hands-on engineer with more than 19 years of experience across business-critical software, identity and session boundaries, browser workflows, systems integration, and authorized vulnerability research.

  • 2 Microsoft-credited CVEs
  • 2026 MSRC Special Mention
  • Coordinated disclosure
View research record How this shapes Azurite
Portrait of Andrew J. Federico Jr., founder and principal architect of Azurite Solutions.
Andrew J. Federico Jr. · Rochester, New York

Public research record

Security findings carried through coordinated disclosure and remediation.

Andrew's public work centers on trust boundaries that matter to enterprise systems: session isolation, origin validation, identity flows, and the assumptions applications make about authenticated context.

Microsoft SharePoint · 2019

CVE-2019-1202

MSRC severity · Important

Microsoft credited Andrew for reporting a SharePoint information-disclosure vulnerability in session-object handling. Under the documented conditions, an authenticated attacker could hijack another user's session. Microsoft corrected the session handling across affected SharePoint Server releases.

Affected surface
SharePoint Foundation 2010 and 2013; SharePoint Server 2016 and 2019
Research outcome
Public Microsoft credit and a security update preventing session hijacking

Microsoft MSAL for Node.js · 2026

CVE-2026-109461

MSRC severity · Important

Microsoft credited Andrew Federico with Azurite Solutions, LLC for an origin-validation vulnerability in MSAL for Node.js. The issue could expose credentials under specific authentication-flow conditions. Microsoft remediated the affected releases in MSAL Node 7.1.0.

Affected surface
@azure/msal-node versions 5.0.0 up to, but not including, 7.1.0
Research outcome
Public credit to Andrew and Azurite Solutions, LLC with a fixed library release

Researcher recognition

Named to Microsoft's 2026 MSRC Special Mentions.

Microsoft included Andrew among 838 researchers recognized for valid vulnerability research during the July 2025–June 2026 recognition year.

View MSRC Special Mentions

Microsoft's acknowledgements recognize Andrew's vulnerability research. They do not represent an endorsement, certification, or security assessment of Azurite™ or Azurite Solutions, LLC.

How the research applies

Research discipline is translated into explicit Azurite™ controls.

Security research trains attention on broken assumptions and hidden trust transitions. Azurite applies that perspective across four equal control surfaces, while keeping customer teams responsible for operational and governance decisions.

Detect

Status Monitor

Verify real endpoint, API, authentication, and browser behavior rather than treating availability claims as proof.

 Communicate

Status Alert

Scope operational guidance to affected applications, groups, and users while preserving publication and audit context.

 Remediate

Cloud Patcher

Separate authoring, approval, signing, verified delivery, scoped activation, suspension, revocation, and rollback.

 Govern

Risk Insights

Keep trust and risk decisions in accountable human review; AI can assist analysis but does not become the authority.

Selected platform controls

Concrete safeguards for changes that reach the browser.

Azurite's posture is expressed through observable controls and recoverable workflows, not a blanket claim that risk has been eliminated.

  • Customer authority

    Customer-controlled deployment and enterprise identity patterns keep operational authority with the organization.

  • Separation of duties

    Role restrictions and lifecycle gates separate editing, approval, signing, activation, and administrative controls.

  • Cryptographic verification

    Signed control packages are verified before execution; missing keys or invalid signatures stop application.

  • Scoped change

    Domain, path, time, audience, version, suspension, revocation, and rollback controls limit where and when changes apply.

  • Operational evidence

    Lifecycle events, execution telemetry, review context, and audit records preserve evidence for accountable follow-through.

  • Human governance

    AI may help summarize and classify evidence, while people retain approval, risk acceptance, and governance authority.

Review the control model

Discuss how Azurite™ protects authority, scope, and evidence.

Walk through the detection, communication, remediation, and governance controls with the architect who designed them.

Request a Demo About Azurite Solutions