Osaka, Japan12:24 JST
Full-Stack Developer Penetration Tester
I build systems end to end — then I try to break them. Full-stack engineering with a security researcher’s instinct for where things give way.
Osaka, Japan HAL Osaka Vocational College
02 — About
I’m a student at HAL Osaka, building production software by day and taking it apart by night.
Most of what I know came from shipping things that had to actually work — APIs that stay up, interfaces people can move through without thinking, and tooling that removes the boring parts of a workflow. I write across the stack because the interesting problems rarely respect the boundary between front and back.
The security side started as curiosity and turned into discipline. Working through authorized assessments taught me to read a system the way an attacker does: assume nothing, verify everything, and pay attention to the seams where two components agree to trust each other.
I’m mentored by a former Netflix Senior Cloud Engineer, which reset my sense of what “done” means. Reliability at scale, observability, blast-radius thinking — the habits that separate a project from a product.
03 — Experience
Authorized engagements & private programs
Black- and grey-box assessments of web applications under written authorization. Reconnaissance, manual verification, impact analysis, and reporting written for the people who have to fix it — reproduction steps, severity rationale, and remediation guidance.
Product work & freelance builds
End-to-end delivery: schema design, REST APIs, authentication, and the interface on top. Comfortable owning a feature from an empty migration file through to the animation that makes it feel finished.
Mentored by a former Netflix Senior Cloud Engineer
Regular review of architecture and code against production standards — failure modes, observability, deployment strategy, and the cost of every abstraction. The fastest source of growth I have.
Independent research
Binary and protocol analysis for the sake of understanding how the machine really behaves. Memory layout, packet structure, and client logic — the discipline that makes every other kind of debugging feel easy.
04 — Security Research
Authorized
Reported & acknowledged
Web application
An authorized assessment conducted through a private bug bounty program. A single high-severity issue was identified, validated, and disclosed to the vendor through their coordinated channel. Details remain confidential under the program’s disclosure terms.
Authorized
Reported to owner
WordPress platform
A permissioned review of a production WordPress deployment covering configuration, exposed surface, and platform hygiene. Six issues were documented with severity ratings and remediation guidance, then handed to the site owner privately. No technical specifics are published.
All work described here was performed with explicit written authorization or under the terms of a public bug bounty program. No vulnerability details, payloads, or proof-of-concept material are published.
05 — Selected Work
Scores a résumé against a job description and explains the gap.
Personal finance tracking that stays out of your way.
Removes the ritual from the commit-and-push loop.
A discography and archive built as a love letter.
Reconnaissance and assessment tooling. Private repository.
Active development
06 — Skills
Five clusters, wired together out there in the dark. Trace one to light it up.
07 — Contact
Open to internships, freelance work, and security research collaboration. If you have something worth breaking or building, I’d like to hear about it.