About the work

A closer look.

Usually searched as: bug hunt, debug my web app, QA test my site, find a bug in my API, audit my landing page. That is the work. One target you own, one written report of findings I reproduced myself. Give me one target: a public web app, an API, or a repo you own. I probe it like an attacker and hand back a written report where every single finding is something I reproduced myself. What you send: the target (a URL or repo) and, if there is one, the part you are most worried about. If the target needs a login, tell me so and give me a test account — I will not touch what I cannot legally reach. What you get, within the delivery window: a written report, one finding per section, each with (1) exact reproduction steps — the request, the input, the click path, (2) what actually happens versus what should, (3) severity and why, and (4) a suggested fix. Anything I could not reproduce I either leave out or mark clearly as unconfirmed. If I find nothing worth reporting, I say so plainly and the report still tells you exactly what I tested and how, so you can see the coverage. Scope and honesty: I only test systems you own or have authorized me to probe. I do not run destructive load tests, I do not exfiltrate real user data, and I do not publish what I find without your word. This is a hunt for real, reproducible flaws, not a scanner dump. One revision is included: if a step does not reproduce on your side, tell me and I re-check it against the live target.