dgxcode

independent pentester · bug bounty hunter

Scanners fuzz inputs. I check who can read order #8842.

I break access control and business logic: the bugs that need two accounts and a reason to try, not a wordlist. Web apps, REST and GraphQL APIs, mobile clients, and LLM agents, tested by hand. Every finding ships with a CVSS 3.1 vector, a redacted proof of concept you can attach to a ticket, and a free retest after you fix it.

Get a fixed quote Read two sample findings
Replay of the sample finding. Synthetic target, no real data.
api=https://example-store.test/api/v1
curl -si $api/orders/8842 -H "$AUTH_A"
HTTP/1.1 200 OK
{"id":8842,"owner":"user-b",…}
user-a can read user-b's order: IDOR
CVSS 3.1 6.5 medium · DGX-EX-014
curl -si $api/orders/8842 -H "$AUTH_A"
HTTP/1.1 404 Not Found
fix verified · finding closed
  • OWASP Top 10 (2021)
  • OWASP API Security Top 10 (2023)
  • OWASP WSTG
  • OWASP MASVS
  • OWASP MASTG
  • OWASP LLM Top 10 (2025)
  • MITRE ATLAS
  • MITRE ATT&CK
  • PTES
  • CVSS v3.1
Scope
Web apps, REST and GraphQL APIs, Android and iOS apps, LLM agents and the tools they call
Method
Manual gray-box testing, business logic first. Scanners add coverage; they never write the report.
Report
CVSS 3.1 vector, reproduction steps, redacted proof of concept, and a fix for every finding
Retest
Included, within 30 days of the report
Quote
Fixed price, usually within 3 business days

What I test

Web & API

Authorization and IDOR across every role, authentication and sessions, injection, SSRF, race conditions, file upload, and multi-step business logic.

Scope and pricing

Mobile

Android and iOS clients: local storage and keychain use, exported components and deep links, certificate pinning, and the API the binary talks to.

Scope and pricing

Source code

The code paths that decide access: authentication, authorization checks, crypto use, secrets, deserialization, and injection sinks.

Scope and pricing

Blockchain

Validator signers, consensus engines, and protocol code. Findings come as harnesses that run against your commit, with message encodings generated from your own codec.

Scope and pricing

Cryptography

ECDH, signatures, JWT, and custom schemes. Invalid-curve exposure is tested with working recovery tooling; timing claims are settled with statistics, not eyeballed medians.

Scope and pricing

LLM & agents

Direct and indirect prompt injection, tool-calling abuse, SSRF through agents, system prompt and data leakage, and guardrail bypass.

Scope and pricing

How an engagement runs

  1. Scope You send targets, roles, and a testing window. I reply with a fixed price and dates.
  2. Authorize Rules of engagement and test accounts are agreed in writing before the first request.
  3. Test Manual testing that starts with who can do what, then how the business flows can be abused.
  4. Report Each finding with a CVSS vector, reproduction steps, redacted evidence, and a fix.
  5. Retest I re-run every fixed finding within 30 days of the report, at no extra cost.

Proof before payment

No client logos, no testimonials, no invented numbers. Instead you get two complete findings from real work, the full report structure, and the standards each test maps to. The complete sample report is available on request.

Read the sample findings Request the sample report

From the work log

Occasionally I publish a write-up when a program allows it or the target is synthetic: what I targeted, what broke, what did not work, and what the receipts look like. The current entries cover a consensus-signing flaw and a panic-reachability proof in a BFT engine.

Read the write-ups

Disclosure

Found a security issue in a Dgxcode property? Email security@dgxcode.com. I acknowledge within 3 business days, agree a fix and disclosure date with you, and credit you on request. Good-faith research inside the policy is covered by safe harbour.

Read the disclosure policy