Pentesting and offensive security
Web audits, exposure review, controlled exploitation, retesting and actionable reports for technical teams.
Capabilities
A rare mix: real offense, product engineering and fast delivery.
This site is focused on concrete work: reducing risk, building maintainable products and accelerating delivery with AI without lowering the technical bar.
AI applications to production
Functional prototypes, full-stack delivery, AI model workflows, automation, security, deploy and real operation.
SaaS, DevOps and architecture
Platform design, integrations, pipelines, cloud infrastructure, performance and maintainability from the first release.
Hardening and technical review
Control validation, public surface, permissions, headers, rate limits, error handling and accidental exposure.
Products
SaaS products I build, ship and run.
Not slideware: real multi-tenant platforms live in production, with billing, authentication, tenant isolation and the same security discipline I apply on the offensive side.
EventTrack
In productionEvent venue management
Multi-tenant SaaS for event venues and planners: real-time agenda, leads, quotes, payments, contracts, staff and a client portal in one place, replacing spreadsheets and scattered chats.
VisualTrack
In productionClinical photo tracking
API-first SaaS for clinical and aesthetic professionals to document visual cases: before/after comparison, clinical views, a secure patient portal, agenda, PDF export and shareable links with strong tenant isolation.
SampleTrack
In productionBiodiversity sampling
Multi-organisation SaaS to plan biodiversity sampling, capture field data with no signal, review identifications taxonomically and deliver defensible reports. Every result traces back to its data, its protocol and its version, and approved reports are frozen with a SHA-256 fingerprint.
Confidential project
In productionFuel logistics · dispatch
Multi-tenant SaaS for fuel haulage operators. It turns each daily route sheet into planned trips with stops, products and assigned units, confirms every delivery point before dispatch, and keeps the run traceable end to end: driver assignment with tank-compartment checks, operational reporting and ISO 14083 carbon footprint. Client is under agreement, so only the sector is named.
Selected work
Other systems I built and put in production.
Custom platforms delivered end to end: product decisions, architecture, security and deploy. Some client work stays unnamed by agreement.
Love Hair
In productionE-commerce · professional hair care
Online store for professional hair colouring: catalogue with hundreds of shade variants, MercadoPago checkout, an automatic colour advisor that builds the full routine from real catalogue products, and an admin panel with audited stock and sales reports.
CEONLINE
In productionProperty management platform
Platform for building and consortium administrators: expenses and settlements, payments and collections, suppliers, amenity bookings, reporting and a self-service portal for owners and tenants.
San Antonio Birding
In productionNature tourism · birdwatching
Natural-history platform for a guided birdwatching operator: field outings with species observations, photo records and sampling, automatic reports as PDF and microsite, on a multi-tenant core so other operators can run on the same product.
Totó
In stagingFrozen food distribution
Distribution management for a frozen food business: mobile POS for the round, a live customer account where debt is derived instead of typed, FIFO allocation of partial payments exact to the cent, inventory with cost and margin per line, and end-of-day close. It replaces a legacy POS app and manual spreadsheets.
Field service system
In stagingTechnical service · maintenance
Internal system for technical service sheets: the technician fills a structured form on site, captures the client signature on screen and the system issues the signed PDF report, with drafts, full history and access auditing. No framework and no database: plain PHP with file storage.
Pentest stats
Recent findings, clear and comparable.
The current pentesting statistics are preserved and displayed with a more direct read by severity, volume and context.
Listed pentests
Critical
High
Total findings
Global distribution
Critical, High, Medium and Low across all loaded results.
HackerOne
Public track record on bug bounty programs.
Coordinated disclosure through the HackerOne platform, where reputation and signal are public and earned report by report.
Reputation
Signal
Impact
Global rank · top 2%
Figures from the public profile, last checked . Rank among ~276,000 hackers with reputation.
Writeups
Published research.
Public recommendations.
Secure contact
Tell me what you want to build, protect or validate.
The form uses server-side validation, CSRF, honeypot, time-trap and rate limiting. It does not publish your email or store the message in a database.
Useful first message
- What you need built, tested or improved.
- Current stack, environment and deadline.
- Security constraints or confidentiality requirements.