I find vulnerabilities in production systems. Public bug bounty programs pay me to do it. Private clients hire me to do it before someone else does.
Public program history. Anything under NDA stays out of it.
Summaries only. I keep company names, endpoints, and repro steps private unless the program lets me publish after the patch ships.
| Severity | Platform | Finding | Impact |
|---|---|---|---|
| CRITICAL | Public API | KYC bypass via alternative registration flow A hidden organization field in an alternate registration flow let me create accounts with KYC enforcement skipped entirely. | Anyone could open a fully-verified account without ever completing KYC, letting unverified users transact as if their identity had been checked. |
| CRITICAL | Public API | NoSQL injection on a WebSocket server REST endpoints correctly filtered NoSQL operators, but the WebSocket connection accepted the same payloads completely unfiltered. | Complete exposure of users’ PII. |
| MEDIUM | Web application | Reflected XSS on registration An unsanitized parameter reflected during registration ran arbitrary script in the context of the newly created account. | Attacker could add a malicious user to the victim’s account right after it was created. |
| MEDIUM | Business logic | Balance limit bypass via alternate flow An alternate request path skipped the check that was supposed to block drivers once they hit their balance limit. View report ↗ | Attacker could keep accepting trips through the alternate path even after they should have been blocked. |
| MEDIUM | Mobile app | IDOR on a hardcoded legacy API endpoint Reverse-engineering the Android app surfaced a deprecated endpoint that was still live and never checked trip ownership. View report ↗ | Exposed sensitive driver details from other users’ trips to anyone who could reach the endpoint. |
| MEDIUM | Public API | IDOR allowing arbitrary driver rating manipulation The feedback endpoint never verified that the trip being rated belonged to the requesting user. View report ↗ | Attacker could submit fraudulent ratings for any trip, inflating their own score or sabotaging another driver’s. |
You talk to me from the scoping call to the final debrief. Nobody hands your app off to a junior tester.
I keep the client count low so each engagement gets weeks of manual testing. You won't get a scanner report with my name on it.
Check current availabilityI'm Marco Candeo, a Brazilian security researcher and penetration tester. I started in software engineering. Security was the plan in university, then a software job opened up and I took it.
Building software taught me to read code and map how a system fits together. Those are the skills I use to take systems apart.
I do red teaming for a handful of fixed clients, and public bug bounty on HackerOne and Bugcrowd.
I teach bug bounty. Each video covers recon and the dead ends before a finding.
Breakdowns of findings I can talk about, published after the vendor ships a fix.
An encoding bypass on a redirect endpoint plus a non-HttpOnly session cookie let one crafted link hijack a victim's account, balance included.
Read writeup →I take three engagements a quarter. Send a rough scope and a timeline. I answer my own email, usually within two days.
hello@bugbountywithmarco.com