Full-stack developer and security researcher from Hungary.

I spend most of my time on open source and security research. I find real bugs, fix them, and get the fixes merged. When I find flaws in other people's code, I prove them first, then report them.

46 merged pull requests across open source so far, 42 of them eligible merges in my current sprint toward 100. My work sits in mypy, Home Assistant, Payload CMS, Medusa, pnpm, prettier plugin-php, and a long list of smaller projects. I prefer fixes with tests over drive-by changes, and I stay on a thread until the maintainer is satisfied.

Code audits and bug bounties. Active on HackerOne, Bugcrowd, Intigriti, and YesWeHack. Every finding gets a working proof of concept before it is reported.

Filed GitHub security advisories:

Octopus-SI-OS

• GHSA-c558-f85p-7349, High
• GHSA-2j3j-m84x-gjfh, Moderate
• GHSA-82h9-785j-3rj4, Moderate
• GHSA-qmhj-fjrr-g529, Low
• GHSA-32mw-j8wg-r86j, Low

Nacos

• GHSA-q43p-chvx-vpx2, High, config authorization cluster
• GHSA-hm4f-5v62-vrm2, Moderate, unauthenticated gRPC lock handler
• GHSA-vffc-gmfm-fwh5, Moderate, unauthenticated admin bootstrap

Experiential

• GHSA-3fwg-p649-gfhr, High, batch grant bypass
• GHSA-5mj6-3wwp-4627, High, budget bundle
• GHSA-8v36-qh6v-jgq4, High, capture working directory code execution

• lazycommit: commit messages written from the actual diff. The clerical part of git, automated.
• ShipCheck: pre-flight checks for shipping web projects, built after one too many broken deploys.
• DepVet: dependency vetting for safer installs, built for a hackathon and kept alive after it.
• benihacking.top: my portfolio. Work history, write-ups, contact.

TypeScript and JavaScript, Python, PHP. Node.js, React, Next.js. WordPress and WooCommerce when the job calls for it. Linux, Docker, Git, GitHub Actions. Burp Suite and the usual audit tooling on the security side.

• GitHub: you are here.
• Portfolio and contact form: benihacking.top
• Writing: dev.to/dextheking1
• Security reports: if I filed an advisory on your project, reply on the advisory. It is the fastest route to me.