Security Researcher · Offensive Security & Vulnerability Research · Bug Bounty
I am a security researcher focused on offensive security and vulnerability research. I identify and responsibly disclose vulnerabilities of every severity, up to and including critical issues, working across public bug bounty programs, private programs, and direct engagements with companies. Much of that work is covered by disclosure agreements, so what is shown here is a small portion of it.
Highlights I can share publicly include a finding on HackerOne's own platform, critical vulnerabilities reported to and resolved by Gebeta and Ethiopian Tender, and a single vulnerability affecting every TGStat domain. Every issue is reported privately first, and nothing appears here until it has been fixed.
HackerOne recognition
Focus areas
How I approach security work, whatever the target.
Hands-on testing from an attacker's perspective, adapted to each target and scoped to the risks that matter most to the business.
Finding, validating, and chaining weaknesses to show real-world impact, from minor misconfigurations to critical issues.
Mapping what an organization exposes and tracing a single root cause across every system that shares it.
Rating issues by realistic impact and likelihood, so teams know what to fix first and why.
Reporting privately, coordinating with vendors, and confirming fixes before anything is made public.
Reproducible steps, accurate severity ratings, and remediation guidance a development team can act on quickly.
Approach
I work with the full range of industry-standard security tooling, covering interception and proxying, reconnaissance, fuzzing, scanning, and API testing, and I choose what fits each target rather than relying on a fixed toolset. Where off-the-shelf tools fall short, I write custom scripts and automation. Tools find leads; manual testing and a close reading of how the application behaves are what turn them into confirmed, well-documented findings.
Disclosures
Vulnerabilities I have reported and confirmed as resolved. Detailed write-ups are available on request, and the public report is linked below.
Experience
Beyond public bounty programs, I have worked directly with product teams to identify and resolve security issues before they reach users.
Security intern. Tested the platform and reported critical vulnerabilities, which the team resolved before they could affect users.
Identified and reported critical access-control and account-takeover vulnerabilities, and supported the team through remediation.
Contact
For security engagements, vulnerability disclosure coordination, or collaboration, please reach out by email.