Security
Security work.
Most of what I build either holds money or holds people's data. So a lot of my time goes into the same question: what should this thing refuse to do, and does it actually refuse it? These are write-ups on that. Breaking my own escrow program on purpose, the security work in two payment apps, a test I wrote for a lead form, and some reverse engineering. Each one is what I actually did, with real code where it helps.
Everything here is my own code or my own analysis. I'm not claiming an audit, a vulnerability in anyone else's system, or any testing I wasn't allowed to do.
- 01Read →
Smart-contract security
Adversarial testing of a Solana escrow
How I test Protected Pay's on-chain program: ~100 tests that try to break it, plus a live run on devnet.
- 02Read →
Payment & financial application security
Security boundaries in two payment apps
API keys, webhook SSRF, bank-token handling, and a payment-existence leak I caught and fixed.
- 03Read →
Web application security
Testing a lead endpoint, and tooling for it
A harness that gets past a bot wall to probe an unauthenticated endpoint, the fix that followed, and a recon toolkit.
- 04Read →
Reverse engineering & API analysis
Reverse engineering web and on-chain systems
Mapping a live tracking container, pivoting on recon signals, and decoding router calldata on-chain.