How I break systems,
so they hold up.
A dedicated breakdown of how I approach offensive security work: the classes of bugs I hunt, the method I follow on every engagement, the tooling I've built, and the ground rules I never break. Authorized testing only, vendor reported first, nothing public until it's fixed.
5+
Organizations' data protected
40+
Downstream orgs shielded
100%
Responsible disclosure
0
Unsanctioned disclosures
WHAT I TEST FOR
Web Application
- —Broken access control & IDOR
- —Authentication & session flaws
- —CORS misconfiguration
- —Server-side request forgery (SSRF)
- —Injection — SQLi, NoSQLi, XSS, template
- —CRLF injection & request smuggling
- —Business logic & workflow abuse
- —403 / auth-wall bypass
AI / LLM Security
- —Prompt injection — direct & indirect
- —Jailbreaks & guardrail bypass
- —Tool / function-call abuse in agents
- —RAG pipeline data leakage
- —Unsafe model-output handling (XSS)
- —MCP server tool-call abuse
API & Cloud
- —Leaked keys & hardcoded secrets
- —Misconfigured object storage
- —Unauthenticated internal endpoints
- —Excessive data exposure in responses
- —Subdomain takeover
- —Missing rate limits & abuse paths
Identity & CI/CD
- —JWT attacks — alg confusion, kid injection
- —OAuth / OIDC flow exploitation
- —SAML / SSO weaknesses
- —CI/CD pipeline & secret exposure
- —Exposed build & deployment artifacts
HOW I WORK
Scope & Authorization
Testing starts only within a published bug bounty scope, a security.txt policy, or written permission from the owner. No exceptions.
Analysis
Map the real attack surface — auth boundaries, trust assumptions, and where untrusted input reaches something that acts on it.
Minimal Proof of Concept
Prove impact with the least intrusive test that demonstrates it. No pivoting, no data exfiltration, no damage to production.
Private Report
A written report with reproduction steps, realistic impact, severity rating, and a concrete remediation recommendation.
Coordinated Disclosure
The vendor gets time to fix it. Nothing goes public until the fix ships and they are comfortable with the write-up.
TOOLING I'VE BUILT
CORS Scanner
Origin-reflection + credentialed-response detection
JWT Attack Scanner
alg:none, RS256→HS256 confusion, kid injection
Access-Boundary Tester
Flags endpoints gated inconsistently across siblings
IDOR Enumerator
Sequential and mutation-based object-reference testing
JS Bundle Analyzer
Extracts endpoints, keys, and auth logic from minified JS
Cloud Recon
Public bucket enumeration across major providers
LLM Red-Team Suite
Prompt-injection and jailbreak corpus runner
Recon Pipeline
Subdomain enum → live hosts → crawl → templated CVE sweep
RULES I WORK UNDER
- —Authorized testing only — in-scope programs or written permission
- —Least intrusive proof of concept that still demonstrates impact
- —No access to, retention of, or exfiltration of user data
- —Private report to the vendor first, always
- —Public write-up only after the fix ships
Want your systems checked before someone else finds the gap?
I work with companies to find vulnerabilities in their web apps, APIs, and AI features — then hand over a clear report on how to close them. Authorized engagements only: you approve the scope in writing before anything is tested.