I find vulnerabilities in modern web apps (GraphQL/Hasura, Firebase, JWT APIs, multi-tenant SaaS)
and help fix them with code that makes sense. Then I build systems the same way I break them.
Real findings from real engagements. All vulns remediated by clients before publication. 🔗 github.com/atendiatec/pentest-samples
| Case | Pattern | Severity |
|---|---|---|
| Hasura GraphQL Multi-Tenant | Cross-tenant IDOR via auto-CRUD + reflective CORS | 6 CRIT · 8 HIGH |
| WhatsApp BaaS Platform | Supabase RPC without auth.uid() — zero-auth to admin |
7 CRIT · 7 HIGH |
| Firebase Auth Bypass | Custom claims without server-side validation | 2 CRIT · 2 HIGH |
| SaaS B2B Delivery | Account takeover + 4-digit recovery brute force | 3 CRIT · 6 HIGH |
| REST API Auth Flaws | JWT HS256 weak secret + mass assignment + SQLi | 3 CRIT · 3 HIGH |
◆ Open-source templates — production building blocks extracted from client work
| Repository | What it does |
|---|---|
| fastify-multi-tenant-starter | Multi-tenant backend — Fastify 5 + Drizzle + JWT + row-level isolation |
| whatsapp-meta-webhook-template | Meta WhatsApp Cloud API webhook — HMAC-SHA256 validation |
| bullmq-job-patterns | BullMQ patterns — retry/backoff, scheduled sweeps, rate limiting |
| docker-traefik-ssl-template | Docker Compose + Traefik v3 + Let's Encrypt — security headers |
◆ How I engage — pricing & process
Every first call is free (~30min). No canned proposal — just to see if it makes sense for both sides.
- Fixed-scope — defined deliverables, set price, set timeline
- Pay-per-vulnerability — predictable cost per confirmed finding
- Hourly — flexible scope, R$ 250-350/h
- Monthly retainer — continuous coverage for fast-iterating SaaS
Scope + signed authorization before any test. Executive + technical report (PoC, CVSS, CWE/OWASP/LGPD). Post-fix retest included.
PGP 8FF4 1FA4 4AAD A849 F152 F96B 90E1 D4E1 3C08 EFE0 · verify
"Build it right. Then try to break it. Ship only what survives."