Build the system. Attack the system. Fix what you find.

A vulnerability is rarely a single bad line. It is a trust boundary that
nobody wrote down - so I write them down: what crosses it, who verifies
it, and what the code does when that check cannot be completed.

The answer to the last question decides everything. A flow that fails
open under load is not a resilient flow; it is an unauthenticated one
waiting for a busy afternoon.

Current focus
  - Web and API penetration testing, with emphasis on authorization
  - Payment, identity and access-control flows that must fail closed
  - CTF challenge design and event-grade challenge infrastructure
  - Reproducible security lab environments

The interface is the operating system. The content is the portfolio.