FREELANCE CYBERSECURITY & VULNERABILITY ASSESSMENTS.
I identify security weaknesses before malicious actors can exploit them. Providing structured, authorized vulnerability assessments for web applications, APIs, cloud IAM access boundaries, and offline security infrastructure.
Ethical & Authorized Scope of Work
All testing is strictly defensive and authorized. I require documented authorization (Rules of Engagement and written client consent) prior to commencing any assessment. Non-destructive methodologies are strictly enforced to protect production data and system uptime.
Areas of Evaluation
Web Application Vulnerability Testing
Deep manual inspection combined with custom automated fuzzing across the OWASP Top 10 vulnerabilities, session hijacking, broken object-level authorization (BOLA/IDOR), and cross-site scripting.
- · Authentication bypass & token validation flaws
- · Insecure Direct Object References (IDOR/BOLA)
- · Server-Side Request Forgery (SSRF) & injection vectors
API Security Audits
Focused testing of RESTful and GraphQL endpoints for data exposure, rate-limit bypassing, improper authorization boundaries, and mass assignment vulnerabilities.
- · GraphQL introspection & query depth exhaustion
- · Missing rate limits and brute-force resilience
- · Secret leakages in error messages & stack traces
AWS & Cloud IAM Policy Reviews
Least-privilege validation across AWS IAM roles, policies, S3 bucket permissions, and security groups to identify privilege escalation paths and over-permissive service accounts.
- · IAM policy wildcard reduction & privilege escalation analysis
- · Publicly accessible resource audit (S3, RDS, EC2)
- · Security group ingress/egress restriction
Offline & Air-Gapped Log Forensics
Statistical anomaly detection (Z-score and Markov chain behavioral transition models) designed for disconnected environments where telemetry cannot leave the local network.
- · Syslog, auth.log, and Windows Event Log parsing
- · Baseline behavioral drift analysis without cloud APIs
- · Zero external network dependencies
OSA: Offline Security Auditor for Air-Gapped Networks
OSA is a single-binary security auditing engine built in Go. It performs statistical anomaly detection on local authentication and syslog records without sending telemetry over the internet, demonstrating deep systems-level security engineering.
What You Receive in the Security Report
Executive Summary & Risk Ranking
A high-level overview formatted for founders and engineering leadership, prioritizing discovered issues by real-world business impact and CVSS 3.1 severity scores.
Exact Reproduction Proof (PoC)
Every finding includes raw HTTP requests, responses, cURL commands, or reproduction scripts so your developers can immediately verify the vulnerability without guessing.
Actionable Remediation Code
Precise code fixes, framework-specific defense patterns, and re-testing verification criteria to ensure the flaw is permanently resolved.
Schedule an Authorized Security Review
Protect your users and infrastructure with an independent, evidence-based security audit.
REQUEST SECURITY AUDIT