A record of verified impact across commercial engagements and independent security research. Real targets, real findings.
Accepted findings across HackerOne, Bugcrowd, and Intigriti. Mostly business logic flaws, access control issues, and auth vulnerabilities. The stuff scanners walk past.
Found a new privilege escalation vector using the tailscale binary. The PR was reviewed and merged into GTFOBins, the Unix privesc reference maintained by the security community.
Manual exploitation of complex web attack chains. Specialized in HTTP request smuggling, server-side vulnerabilities, and business logic exploitation.
[ View Certificate ]Covers auditing and compromising misconfigured AWS, Azure, and GCP environments. Lateral movement, identity exploitation, privilege escalation in cloud.
[ View Certificate ]Active Directory exploitation, network pivoting, and post-exploitation in enterprise environments. Hands-on exam: full-scope engagement with a client-ready report.
[ View Certificate ]Hands-on AI red team certification, curriculum co-developed with Google. Covers LLM prompt injection, output exploitation, adversarial ML, and AI privacy. Aligned with Google SAIF, OWASP ML Top 10, and OWASP LLM Top 10 (2025).