I'm MASKNODS, an independent security researcher focused on API security, web application vulnerabilities, and responsible disclosure.
Cross-tenant IDOR, database queries unscoped to session tenant, and mass assignment.
Database-level query scoping (`WHERE id = ? AND tenant_id = ?`) and policy-as-code assertions.
Methodical testing domains and architectural boundaries examined during security assessments.
Systematic inspection of API architectures to uncover authorization gaps, schema violations, and data leakage across modern cloud endpoints.
Auditing complex web applications for input handling breakdowns, client-side execution boundaries, and server-side request manipulation.
Deep testing of identity providers, OAuth2 / OIDC implementations, session state mechanics, and vertical/horizontal privilege escalation vectors.
Uncovering architectural flaws where application code executes as programmed but violates business assumptions, creating financial or data risk.
Methodical mapping of complex digital assets, subdomains, undocumented endpoints, and third-party dependencies to formulate reproducible hypotheses.
Committed to ethical Coordinated Vulnerability Disclosure (CVD). Providing actionable reproduction steps, technical evidence, and retesting assistance.
Broken Object Level Authorization (BOLA/IDOR) remains the number one vulnerability in the OWASP API Security Top 10. This writeup examines root causes, detection patterns, and architectural defenses.
JSON Web Tokens are widely implemented for stateless authorization, yet improper library usage and key management frequently introduce critical authentication bypasses.
A structured methodology for systematically uncovering horizontal and vertical privilege escalation across role-based access control (RBAC) surfaces.
A disciplined, hypothesis-driven workflow designed to uncover critical architectural and business logic defects without disrupting target infrastructure.
Non-intrusive asset discovery, organization scope verification, and architecture profiling.
Exhaustive inventory of API endpoints, routing logic, parameters, and authentication barriers.
Analyzing developer business assumptions to isolate potential logic and authorization gaps.
Executing controlled, minimal, zero-harm proofs of concept to confirm security defects.
Constructing actionable, high-signal reports following Coordinated Vulnerability Disclosure.
Query identity details, research domains, and published papers via a sandboxed client-side shell.
MASKNODS — Independent Bug Bounty Hunter & Security Researcher
Focus: API Security, Web Application Security, Vulnerability Research.
Tagline: "Breaking Assumptions. Securing Systems."
Open to security research collaboration, responsible disclosure discussions, and technical conversations.