CriticalPrivate program
Cross-tenant object access in a SaaS API
Broken object-level authorization allowed reading another tenant's records by changing a single identifier. Fixed with a server-side ownership check on every object route.
Bug bounty · Web & API security
I break web apps
so they get fixed.
Independent security researcher hunting access-control and authentication bugs in web applications and APIs. Manual testing first, source-assisted where scope allows, clear reproduction steps in every report.
- FocusAccess control · Auth logic · SSRF
- MethodManual testing + source review
- StatusOpen to private programs
01
Selected findings
A sample of vulnerability classes I work with. Company names and raw evidence are withheld wherever disclosure terms require it.
HighPrivate program
Password-reset token replay
Reset tokens stayed valid after use and after a password change, allowing replay inside the token lifetime. Fixed with single-use tokens and session invalidation.
MediumPrivate program
Blind SSRF through image import
An import endpoint fetched arbitrary URLs server-side, reaching internal metadata services. Fixed with a destination allowlist and egress filtering.
// details redacted where required by program policy
02
Toolkit
Small, deliberate set of tools. Most time goes into reading requests, responses, and source code.
Web & API
- Burp Suite
- DevTools
- ffuf
- nuclei
- Postman
Code
- Python
- JavaScript
- SQL
- Bash
- PHP (read)
Infra
- Linux
- Docker
- Git
- nginx
- Wireshark
03
Disclosure
I test only inside the scope published by each program and follow its rules of engagement. Findings go straight to the vendor with reproduction steps; public write-ups only after disclosure terms allow it.
- No testing without written scope and permission.
- No data exfiltration, no persistence, no service disruption.
- No testing of third parties, employees, or production data beyond proof of impact.
- Report first, publish later — and only when the program permits it.
04
Contact
For private programs, triage questions, or a second pair of eyes on an auth bug.
PGP
Fingerprint on request. Encrypted reports welcome.