Security research
I test web applications and APIs on Bugcrowd programs. Most of my findings are about trust: a server that acts on an identifier without checking who owns it, a flow that can be reordered, a login that links identities too loosely.
Every test runs between accounts I created, with data I invented, and stops at the smallest request that proves the problem. Whatever I change, I put back.
Ranked among Bugcrowd's global Top 50 researchers in June and July 2026.
I have been researching on Bugcrowd programs since March 2026. The profile is the only public record I keep of the work; everything else stays with the programs that received it.
- Top 50Global · June 2026
- Top 50Global · July 2026
- Mar 2026First program
What I look for
Nine classes of problem, in roughly the order I check for them. Pick one to see what I look for, why it matters, and how I test it without touching anyone's real data.
Why one check matters
A tiny invoice API with two invented accounts. Choose who is asking, which invoice they ask for, and whether the server bothers to compare the two. Nothing here leaves your browser.
All accounts and records here are invented.
invoice = Invoice.find_by(id: params[:id], owner_id: current_user.id) || forbid!How I test
Eight rules I follow on every program. They exist so that a report from me is safe to receive, easy to reproduce, and quick to fix.
What a report from me looks like
The shape of a real report with the target removed. The example is an invented invoice endpoint, the same one as the lab above.
How each class gets written up
Seven patterns, each in the three lines that matter: what was found, how it was proven with the least possible impact, and how it gets fixed. No program, host or payload is named anywhere on this site.
What the research changed in what I build
Each product now carries a decision I would look for as a researcher. The case studies have a section for it.
Found something in one of mine?
Clex, Clex AI, Driped, trgt, Modih Mail and this site are all mine, and I would rather hear about a problem from you than from anyone else. Email [email protected] with steps to reproduce, and give me a few days to respond before anything is published.
What I ask in return is what I do myself: test against your own accounts, keep the proof minimal, do not access, change or keep anyone else's data, and do not run anything that degrades the service.