z3rco 
Junior Security Researcher · Source Code Auditor
I'm a security researcher specialized in finding critical vulnerabilities in production web applications. My work spans content management systems, finance platforms, SaaS products, and hosting infrastructure — the kind of software that businesses bet their operations on.
I've been assigned multiple CVEs against widely-deployed platforms, ranging from high-severity IDOR chains through GraphQL APIs to CSRF bypasses in security-critical admin workflows. These aren't theoretical — they affected real deployments at scale.
My approach is manual, source-driven testing. I read code, map logic, and find the flaws that automated tools don't catch — broken access controls, authentication bypasses, API authorization gaps, and chained exploits that turn low-severity issues into full data exposure. Every report I submit includes a working proof of concept, CVSS scoring, and actionable remediation.
I work through bug bounty programs and independent research, and I've been ranked among the top-paid researchers on active bounty platforms. If your application handles user data, payments, or access control — I'll find what your pentest missed.
Responsible disclosure. Always.
Offensive
Languages & Tooling
Python 
Bash 
JavaScript 
C 
C++ 
C# 
Rust 
Zig 
Go 
Java 
Kotlin 
PHP 
MySQL 
Linux Domains
Craft CMS
IDOR via GraphQL @parseRefs directive — unauthenticated access to sensitive attributes of any element in the CMS, bypassing all authorization checks. Full PII enumeration, server path disclosure, and database query as system user.
Craft CMS
Information disclosure via unchecked asset relocation — authenticated users could expose sensitive assets through maliciously crafted requests targeting user profile photos.
Concrete CMS
CSRF in Anti-Spam Allowlist Group Configuration — changes saved prior to CSRF token validation, allowing a rogue administrator to manipulate the group_id parameter and bypass security checks.
Need a security assessment? Found my work through a bounty platform? Want to collaborate on research? Reach out.