Projects
- Home
- Projects
"Prevention is cheaper than a breach"
Led adversarial simulations and full APT campaigns against a major financial institution in Japan, testing paths to core banking systems.
View Details
APT Simulation — Financial Sector
Multi-jurisdictional darknet investigations with cryptocurrency tracing (BTC, XMR, ETH) and digital forensics supporting international law enforcement.
View Details
Darknet Investigation — Law Enforcement
Full-spectrum security operations for government networks — from infiltration testing to detection engineering.
View Details
Government Network Defense
Web, API and cloud penetration testing delivering OWASP/CVSS-rated findings and documented exploit chains.
View Details
Enterprise Penetration Test
SOC/SIEM-driven threat hunting and incident response following a suspected intrusion, from triage through containment.
View Details
Incident Response & Threat Hunt
Security-first full-stack platform (React/Node/Python) built with DevSecOps practices and a zero-trust architecture.
View Details
Secure SaaS Build
An open-source JavaScript library I wrote and maintain: it validates URLs before outbound requests to block SSRF. Listed by the OWASP Foundation as a defense tool, with 300K+ npm downloads.
View Details
DSSRF — OWASP-Listed SSRF Library
A pre-launch pentest of a fintech trading platform: a GraphQL API answering privileged queries with no token, escalation to administrator, and secrets shipped inside the container images.
View Details
Trading Platform Pentest — API to Rogue Admin
Unpacking router, TV-box and camera firmware to find static keys, plaintext management and unauthenticated debug protocols — disclosed through vendor PSIRT and CISA, including CVE-2026-58378.
View Details