Independent developer working on application security: secure code review, threat modeling, and vulnerability remediation with regression coverage. Based in Araraquara, Brazil.
Focus: finding real flaws in software I own or am authorized to test, fixing them, and proving the fix holds with automated tests.
Only software I build, deliberately vulnerable applications I create, and local containerized labs. No third-party systems. Scope and authorization are documented explicitly in each project — see AUTHORIZATION.md.
discovery → controlled validation → root cause → remediation → regression test → write-up
The deliverable is the patch and the test that keeps the flaw from coming back — not the exploit.
| Project | What it demonstrates |
|---|---|
| CSA-LAB | Reproducible AppSec lab. 6 documented findings (IDOR, SQLi, path traversal, session forgery, business-logic, SSRF) with proof-of-concept tests, patched variants, and a passing regression suite. Localhost only. |
| freeband-nextjs | Next.js/TypeScript app with a STRIDE threat model, documented security review, authentication hardening, regression tests and GitHub Actions CI. |
| Shopping-Cart-Project | Server-side Stripe payment integration with documented trust boundaries and a vulnerability reporting policy. |
| CSA-Obsidian | Browser automation toolkit (Camoufox + MCP server) for authorized QA, accessibility auditing and agent evaluation. |
| TranslatePDF | PDF translation preserving layout, fonts and images. |
TypeScript · Next.js · Python · Rust · PostgreSQL · Docker · GitHub Actions