offensive security researcher. i hunt hostile-input bugs - the kind that pop when a security tool eats attacker-controlled data - and i run responsible disclosure campaigns against whoever ships them.
- 🔎 tool audits - i point scanners, frameworks and agents at themselves. recent reports: Tenable, Rapid7, Greenbone
- 💥 CVE PoCs - weaponized proof-of-concepts in my spare time (see below)
- ☁️ cloud red team - AWS / GCP attack paths, role juggling and privilege-escalation mazes
- 📻 hardware bench - Flipper Zero + ESP32 counter-surveillance: hunting Flock/ALPR cameras and rogue BLE trackers
- 🐍 languages - Python first, Ruby for module dev
score so far: 2 fixed (1 with a bounty 🏆) - 1 partially fixed - 4 ghosted 👻 - 3 refused - 1 pending public writeup
these are feeding a security conference talk.
| # | target | contacted | outcome | notes |
|---|---|---|---|---|
| 1 | REDACTED1 | Jun 12, Jul 2 |  |
declined to fix |
| 2 | REDACTED2 | Jul 8, 10, 20 |  |
no response |
| 3 | REDACTED3 | Jul 15, Jul 26, Jul 2, Jul 10, Jul 20 | |
no response |
| 4 | REDACTED4 | - |  |
part of the potential Black Hat Europe talk |
| 5 | REDACTED5 | Jun 21, 26, Jul 10, 20 | |
no response |
| 6 | REDACTED6 | Jun 20, 25, 27, Jul 3, 13, 20 | |
PoCs delivered, then silence |
| 7 | REDACTED7 | May 6, 15, Jun 15, 21, 26, 30 |  |
some vulns fixed |
| 8 | REDACTED8 | Jun 21, Jul 2, 10, 13, 20, 20, 21 |  |
vulnerabilities fixed |
| 9 | REDACTED9 | Jul 8 | |
tickets marked resolved, not interested |
| 10 | REDACTED10 | Jun 27, 29, Jul 2, 10 | |
tickets closed as resolved/spam |
| 11 | REDACTED11 | Jul 24 |  |
fixed, bounty paid |
| vendor | channel | submitted | status |
|---|---|---|---|
| Tenable | HackerOne 3971365 | Aug 26 |  |
| Rapid7 | support ticket #142316 | Aug 27 | |
| Greenbone Security | direct email | Aug 29 | |
| CVE | PoC |
|---|---|
| CVE-2026-19626 | POC-CVE-2026-19626 |
| CVE-2026-19679 | POC-CVE-2026-19679 |
| CVE-2026-19681 | POC-CVE-2026-19681 |
more in the oven as disclosures clear.
full list of external repos (not mine) that i've sent PRs to:
593 upstream PRs to 25 external repos (repos i don't own), plus 25 collab PRs in friends' forks
metasploit module work usually starts in friends' forks before it lands upstream:
no vendors were harmed in the making of this page. they were just politely emailed and called. repeatedly.