Test your application before the next release.
Find attack paths affecting accounts, data and critical workflows across web, mobile or desktop software.
You receive
Validated findings, reproducible evidence and prioritized fix guidance.
I help you findvulnerabilities in your appbefore attackers do.
I test web, mobile and desktop applications and their APIs for the flaws scanners miss: broken access control, unsafe data handling, business logic and native-code bugs. You work directly with me, from scoping to the final walkthrough.
- 150+ security vulnerabilities reported
- 7 Facebook & Instagram vulnerabilities acknowledged by Meta
- 9 Linux kernel patches in mainline, including fixes for 2 CVEs
- Built Hendra, a context-aware DAST scanner
01Services
What do you need answered before your next release?
Pick the question. I will scope the smallest engagement that answers it.
Get to the cause in your code.
Review a critical feature, inherited codebase or native component. Follow the data and permissions to understand the risk.
You receive
Code-level analysis, root causes and remediation options your developers can act on.
Check an AI-built app before real users arrive.
Cursor, Lovable, Bolt and similar tools write working code fast, and they often leave access checks out. I test authentication, data access and exposed keys before launch.
You receive
A short fix list in order of risk, with the exact code or configuration to change.
Build the security tool you actually need.
Develop SAST or DAST capabilities, extend a scanner or turn a research method into an evaluated implementation.
You receive
Detection components, architecture decisions and a repeatable evaluation.
02About
Why a researcher who also builds software
Scanners report symptoms. I trace each finding to the code that causes it and to a fix your developers can ship.
I find the cause, then write the fix.
I wrote the patches behind two Linux kernel CVEs and seven more fixes now in mainline. On your product, each finding comes with the code path, the conditions that trigger it and a fix your team can review.
I build software, so my fixes fit your codebase.
I have led web development and designed a DAST scanner from its architecture up. When I recommend a fix, I have already considered how your team will implement and test it.
The person who scopes your test runs it.
I agree the scope with you, run every test myself and walk your developers through each finding.
03Expertise you can verify
Vulnerabilities I reported, and fixes I wrote
01
Meta Bug BountySeven Facebook and Instagram vulnerabilities, acknowledged by Meta.
I reported security vulnerabilities in Facebook and Instagram through Meta’s bug bounty programme, and Meta’s security team validated and acknowledged seven of them. Also a researcher on the Bugcrowd platform.
- Meta
- Facebook · Instagram
02
Linux kernelTwo Linux kernel CVEs, fixed by my own patches.
A NULL-pointer dereference in Intel’s ice network driver and a 32-bit overflow in the JFS filesystem. Both fixes went into mainline Linux, and the ice fix was backported to stable kernels.
- CVE-2024-26855
- ice_bridge_setlink()
- CVE-2025-37858
- JFS · 32-bit overflow
Fig. 01
Hendra · DASTHendra: the DAST scanner I designed and built.
For my completed doctoral research at ITMO University, I developed Hendra’s architecture, scan planning, request deduplication, finding verification and evaluation framework. Application context guides which checks the scanner runs.
- ITMO
- Hendra
- Role
- Architecture, implementation and evaluation
58.5×Fewer requests
Recorded in my project research: DVWA at low security, under the tested tool configurations. F1 combines precision and recall. These figures describe this experiment, not a universal ranking or a production performance guarantee.
In the media
The researcher behind the reports.
Watch my TV interview about Meta vulnerability research. Then examine the public findings, accepted fixes and scanner research that support my work.
Watch the TV interview
Conference speaker · ISP RAS Open 2024
Research presented in Moscow.
At ISP RAS Open 2024, I presented my research on using machine learning to predict web-stack technologies beyond traditional fingerprints. My talk is listed in the official conference programme.
Predicting web-stack technologies with machine learning: beyond traditional fingerprints
A practical question behind application testing: what is the software actually built with?
View the conference programme04Services
Web, mobile and desktop applications, tested by the same person.
Web & APIs
Authentication, permissions, sensitive workflows and the application behind your API. My strongest and preferred area of practice.
View serviceMobile applications
The application, its local data and its connection to backend services, with the platform and API boundaries agreed explicitly.
View serviceDesktop & native software
Application code, libraries and components handling untrusted input. C, C++ and Java projects scoped around the risks that matter.
View service05From your first question to a useful result
How an engagement runs
Send a short brief
The product, what changed, what you need to know and by when. A paragraph is enough, and I reply within three days.
Get a written proposal
Scope, method, exclusions, deliverables, price and dates. Confidentiality, NDA and retesting terms are agreed in the same proposal.
Follow the work as it develops
For assessments, you see evidence and priorities as they emerge. For engineering, you review the agreed milestones.
Report and walkthrough
You receive the report or the delivered work and a walkthrough with your team. Any further fixes or verification are agreed with you.
06Tools & publications
The scanner I built and the research behind it
For my completed doctoral research at ITMO University, I developed Hendra’s architecture, scan planning, request deduplication, finding verification and evaluation framework. Application context guides which checks the scanner runs.
Every HTTP(S) request should be necessary, non-redundant, and contextually relevant.
I design and develop SAST and DAST applications.
Security tool engineering spans architecture, detection logic and evaluation. I help teams turn a defined analysis problem into an implementation they can test, understand and extend.
Explore security tool developmentResearch contributions
Behavioural technology identification
Combining learned signals and explicit rules to identify application technologies.
Feature-equivalence request deduplication
Reusing equivalent requests with attention to context and scanner state.
Context-enriched Attack Surface Graph
Representing endpoints, parameters and their relationships in an attack-surface graph.
Context-aware payload selection
Selecting checks using application context and detected technologies.
Evidence-based finding adjudication
Examining response evidence to distinguish actionable findings from noise.
Reproducible DAST benchmarking
Comparing scanner outcomes on defined targets with repeatable measurements.
Selected publications
- DASTestBed: An Automated Benchmarking Framework for DAST Scanners with Extensible Ground Truth Modeling
- Feature-Equivalence Deduplication and Memoization of HTTP(S) Requests for Web Scanners: Formal Model, Concurrency, and Complexity Bounds
- Weakly Supervised Web Technology Identification with Rule-Augmented Machine Learning
Hendra shows how I connect security research to working scanner components and measurable tests. That experience can support a custom tool, an existing security product or a focused evaluation.
07Blog
How I review real vulnerabilities
CVE explainers, code review patterns and practical guidance for people who build and own software.
The Asterisk Paradox: CVE-2026-123158 and the OpenSSH–musl Authentication Bypass
Two unrelated systems both chose the character "*" to mean "nothing usable here." CVE-2026-123158 traces exactly how that collision bypasses OpenSSH password authentication on musl-based Linux, what a pinned-digest lab run did and did not confirm, and the one question it left open.
Read articleCVE-2026-118527: The Ivanti CVE CISA's Own Catalog Can't Explain
CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog two weeks after CVE-2026-104935. One closes a gap from the original piece. The other raises a question nobody has answered yet.
Read articleCVE-2026-97229: the asterisk on GitLab’s ‘unauthenticated’ RCE
GitLab’s CVSS 10.0 and CISA’s KEV call this unauthenticated. The only two people who made it work needed a GitLab account first. Here’s why that matters.
Read article
08Contact
Shipping something that handles user data?
Send me a short brief. I reply within three days with questions or a proposal outline, and the price is agreed in writing before work starts.