Pentest, bug bounty and reverse analysis.

Follow an access-control flaw, build a reproducible report or trace a decoder. Start with a specific question and evidence another researcher can inspect.

Application pentesting

Trace an exposed route from request to authorization decision. Turn response differences and source excerpts into a focused test plan.

Bring this material: A handler, the ownership rule and owner/non-owner request pairs with secrets removed.
Work toward this result: A server-side ownership check and a regression that proves cross-tenant denial.

Explore this use case

Synthetic exampleObject-level access control

json

{
  "object": "report_demo",
  "owner": "tenant_a",
  "caller": "tenant_b",
  "expected_status": 403,
  "observed_status": 200
}

The status difference is a starting observation. Confirm the returned field, ownership rule and server-side lookup before calling it a disclosure.

Bug-bounty research

Organize a narrow hypothesis, compare HTTP evidence and write a report another researcher can reproduce.

Bring this material: Program scope, two synthetic identities and a baseline with one changed input.
Work toward this result: Reproduction steps and an impact statement limited to the behavior you actually observed.

Explore this use case

Synthetic exampleA minimal HTTP exchange

http

GET /api/reports/report_demo HTTP/1.1
Host: target.example

HTTP/1.1 200 OK
Content-Type: application/json

{"id":"report_demo","body":"synthetic evidence"}

The host, identifier and response are illustrative. A finding needs your own baseline, non-owner exchange and reproducible impact.

Malware and reverse analysis

Inspect a binary’s structure and selected disassembly. Trace configuration and imports without turning guesses into observed behavior.

Bring this material: A file identity and selected imports, disassembly or decompiler output.
Work toward this result: An explanation tied to offsets and functions, with untested runtime claims kept separate.

Explore this use case

Synthetic exampleA selected decoder loop

for (size_t i = 0; i < size; i++) {
    output[i] = input[i] ^ key;
}
return validate_length(output, size);

A transformation in source is not proof of execution. Follow its callers and output consumers before assigning runtime behavior.

Continue with code and detections

Source-code reviewFollow untrusted input into a sensitive operation. Ask for a small patch, a counterexample and a regression test.Detection engineeringTurn a documented behavior into a testable rule. Work through telemetry requirements, benign counterexamples and coverage gaps.

Application pentesting

Bug-bounty research

Malware and reverse analysis

Continue with code and detections

Need an endpoint, command or limit?