Every one of them shipped a fix after a report with my name on it.
Where the bugs were
Nine companies, six countries. Eight of them shipped a fix; the ninth wrote back to say thanks. Every curve is a report that left here and landed there — pick a marker to read what broke and how far it reached.
What I do
Manual offensive testing for companies that ship software. The same work that produced the map, pointed at your product.
Web application testing
Login and session handling, who is allowed to see what, the business rules underneath, and anywhere user input reaches an interpreter.
API assessment
REST and GraphQL. Object-level access control, fields the client was never meant to set, rate limits, and data that comes back to the wrong caller.
Vulnerability research
Research aimed at your stack rather than a checklist: new bugs, and patches that closed one path while leaving its siblings open.
Source code review
Reading the code for the decisions a scanner cannot see — trust boundaries, deserialization, crypto use, and access checks that run too late.
How an engagement runs
Four stages, in order. You see what was tested, not just what was found.
Scope and recon
Agree what is in play, map the surface, and identify the stack and the third parties behind it.
Manual testing
Hand testing against auth, access control, business logic and injection. A scanner run is not a report.
Proof and escalation
Every finding gets a working proof, then gets pushed to its real worst case before it is written up.
Report and retest
Reproduction steps, impact, and a fix to aim at. I retest once you have shipped it.
Let's work together
Need an assessment, or have something to disclose? Write to me.
- Availability
- Taking work now
- Reply time
- Under 24 hours
- Based in
- India, remote worldwide
- Hours
- IST, UTC+5:30