Application Security Engineer and AI Security Researcher. I break apps, build secure systems, and create tools that help teams ship safer software.
About
I'm an Application Security Engineer with 4 years of experience. My work spans pentesting, vulnerability research, and building security tools used by researchers worldwide. Day-to-day I handle secure code review, building security into CI/CD, and working with dev teams to fix vulnerabilities before they hit production.
I specialize in API security, web and mobile application pentesting, and breaking systems to understand how to build them stronger. Lately I've been focused on AI security - prompt injection, model manipulation, and building security integrations for AI-powered systems. I also build open-source tools when I can't find exactly what I need for a job.
Expertise
Pen testing web apps, APIs, and mobile apps. Secure code review, vulnerability assessments, and working with dev teams to ship safer products.
Building security into the SDLC. DevSecOps pipelines, SAST/DAST integration, secure coding guidelines, and automated vulnerability scanning. Security as part of the build process.
Testing REST and GraphQL endpoints for injection, broken access, auth flaws. Built a vulnerable GraphQL API for teaching and testing security tools.
Researching security implications of AI systems - prompt injection, model manipulation, data poisoning. Building security integrations for AI-powered applications.
Android app testing - static and dynamic analysis, Frida instrumentation, checking how apps store data and handle authentication on the device.
Testing cloud infrastructure and configurations on AWS and Azure. IAM policies, storage permissions, serverless functions.
Testing embedded devices and IoT ecosystems. Firmware analysis, hardware interfaces, network traffic.
Building tools I wish existed. Barrel (Android Research Workbench), grAPI (live API discovery), Vulnera (DAST scanner), and other projects.
Finding XSS, SQLi, CSRF, IDOR, and auth bypass issues in production web apps across finance, healthcare, and transport.
Experience
Projects
Desktop app for Android security research. Shell, logcat, file explorer, Frida, APK analysis, network inspection, SQLite browser, and a plugin SDK. Free tier available with paid plans for advanced features like unlimited plugins and remote device access.
A GraphQL API with intentional vulnerabilities for learning security. Built with C++17 and PostgreSQL - covers injection, broken access control, misconfigurations, and 7 vuln categories. Comes with a Docker setup and an MCP server for AI integration.
A web app that generates static analysis security reports. Feed it your code or scan results and get a clean, structured report you can actually use.
Discover hidden API endpoints on any website by browsing it in a real browser. Captures XHR/Fetch calls and scans JS files for hardcoded paths. Exports to txt, JSON, or Postman collection. Available on PyPI as grapix.
A DAST scanner that fits into CI/CD pipelines. Runs automated security checks on web apps during builds.
Tests for open redirect vulnerabilities with a browser extension for quick, hands-on testing.
Blog posts about vulns I've found and techniques I've used. Covers web security, API flaws, mobile bypasses, CI/CD hardening, and OWASP top 10 breakdowns.
Security labs, pentesting tools, and resources I've shared on GitHub. Includes vulnerable-by-design apps for practicing exploitation.
Certifications
Contact
Looking for security consulting, pentesting, or full-time roles in appsec. Also open to interesting projects and collaborations.