About

For close to seven years, alongside other technical work, I've investigated business-logic and web application vulnerabilities — what began as personal curiosity became a recurring, if never full-time, part of how I work. Bug bounty rewards alone were never a realistic living, but the habit of looking stuck.

Most of my technical background is in process and browser automation — a large number of scripts over the years, many of them built in Browser Automation Studio — and that same systematic approach now shapes how I look for vulnerabilities: methodically, not by chance.

I also hold a Master's degree in Law, which is why I can pair each disclosure with country-specific information about the affected person's actual legal rights — not legal advice, but grounded, sourced context most breach victims never get.

I'm currently building an entity resolution service based on data breach dumps. It lets verified individuals see exactly what information about them may already be exposed to attackers, and gives businesses a risk score for their own customer base, built on the same underlying data.

On this site, I publish two kinds of work: case studies from vulnerabilities I find and responsibly disclose, and periodic analysis of freshly surfaced breach dumps — read and analyzed by me directly, not summarized from someone else's report.