Four practice areas, one operating model: deep technical research, delivered as engagements or focused vulnerability programs.
IAM authorization audits, multi-tenant isolation review, SSRF & cross-account paths, CSP-specific bypass research (AWS / GCP / Azure).
Android & iOS app review, SDK misconfiguration hunting, runtime instrumentation, supply-chain risk in third-party libraries.
Prompt-injection, agent jailbreaks, tool-use abuse, model supply-chain. CVP-approved on Anthropic’s program.
Adversary emulation across web, identity, and infrastructure. Chained 0-click exploits, federated-IdP abuse, desktop-client takeover.
Active researcher on HackerOne (@poneglyph) with disclosed reports across consumer, enterprise, and AI programs. CVP-approved on Anthropic’s Claude Vulnerability Program.
A non-exhaustive list of organizations whose public security programs we've reported valid issues to.
Wordmarks shown for reference. Not affiliated; not endorsements.
Selected write-ups from public bounties, internal research, and engagements where disclosure was authorized.
For consulting, scoped engagements, AI security review, or red-team retainers. 30-minute intro call, no obligation.