About
I started by building products
Security changed how I read them
For a few years I shipped things: a file workspace, a model gateway, a subscription tracker, a race-weekend app, a disposable mailbox. Each one taught me how software behaves once real people and real traffic arrive.
In March 2026 I started security research on bug bounty programs. The work is mostly reading: how a request proves who it is, what the server checks before it acts, and where the two drift apart. Most of what I report sits in authorization, authentication and business logic, not in exotic exploits.
That reading now runs backwards into what I build. Every feature gets the questions I would ask a target: who can call this, with which object, and what happens if the steps arrive out of order.