I am an Application Security Engineer with 7 years of experience. I mainly focus on securing web/mobile applications and APIs, while also reviewing source code and cloud environments. I use my programming background to build custom automation tools, and I combine deep manual testing with AI to find complex bugs.
In my spare time, I do vulnerability research to keep my skills sharp. I work with large organizations to help them identify and patch their security flaws. My vulnerability reports have been rewarded by major companies like OpenAI, BMW, and Coca-Cola.


















Exploiting shared database logic to bypass tenant boundaries, chained with a CSRF to destroy enterprise API keys.
Bypassing RBAC to leak sensitive restricted workspace data by exploiting separated event logs.
Exploiting an API-level IDOR to maintain persistent access and disable webhooks after UI permissions were revoked