Methodology, writeups, and hard-won lessons from breaking applications and building the tools to break them. This is the clearest picture of how I actually work.
I built a publication gate to stop client data leaking out of a security toolkit. It passed. Then I checked what it was actually scanning — and found five silent failures, four of them mine.
Prompt injection means you can't trust what an LLM decides to do with its tools. Assume the model is compromised, fuzz the tool-use boundary to find where it breaks, then contain it with a fail-closed runtime kernel.
Broken access control tops the OWASP list and generic DAST tools are structurally blind to it — because they only ever see one user. Here's why, and how a multi-identity engine fixes it.
What it takes to build a corporate vulnerability scanner that runs with zero outbound connections — and why building the tool made me a sharper manual tester.
The methodology in these posts is exactly what I bring to an engagement.
Book an assessment →