ozz

I'm an application security researcher currently looking for my first role in AppSec or security analysis. Over the past two years I've been learning and doing bug bounty work — mostly web apps and APIs. I've reported real vulnerabilities in production environments: broken access control, SSO issues, and authentication flaws. Nothing massive, but real findings in real systems. I'm comfortable with Burp Suite, manual testing, and writing clear reports. I also built a small recon pipeline (OzzMon) that runs on GitHub Actions to monitor attack surface changes. Still learning. But I test carefully, document thoroughly, and don't report noise.

Selected vulnerability reports and technical writeups based on real-world findings.