$ whoami

zeeebox55

Independent security researcher. Web application vulnerabilities, API security, and business logic flaws across bug bounty programs.

$ cat ./stats.json

{
  "vulnerabilities": 200+,
  "programs_tested": 30+,
  "platforms": ["hackerone", "yeswehack", "bugcrowd"]
}

$ ls ./achievements

$ cat ./expertise

auth IDOR, broken access control, OAuth/OIDC, JWT, privilege escalation, tenant isolation
server-side SSRF, SQLi, SSTI, RCE, deserialization, request smuggling, cache poisoning
business-logic payment manipulation, race conditions, state machine abuse, scope param exploitation
api GraphQL auth bypass, REST misconfig, mass assignment, credential leakage
client-side XSS, CORS, postMessage, open redirect chains, cache deception
recon attack surface mapping, JS analysis, archive mining, subdomain enum, secret detection

$ methodology

#depth-over-breadth #manual-first #business-logic #impact-driven #kill-chain

depth over breadth — one target deeply understood beats ten shallowly scanned
manual-first — automation for recon, hand-built requests for exploitation
business logic focus — what the app does matters more than what tools find
impact-driven — every finding answers "what can an attacker do right now?"
full kill chain — chain low-severity primitives into high-impact exploits

$ links

hackerone yeswehack

$ contact

Responsible disclosure, collaboration, or consulting — [email protected]