Papers.
Work that needed more room than a post. Published here in full, free to read and free to cite, each copy signed so any change to it after publication is detectable.
Elsewhere
Shorter write-ups are on the blog. Vulnerabilities we report in third-party software are listed under advisories.