Work

Security research and responsible disclosures.

• CDE Secret Exposure Research

  Scanned 22 million public projects across CodeSandbox, StackBlitz, CodePen, and JSFiddle, uncovering 8,792 verified live secrets.

  Apr 2026•Truffle Security•Featured•Published on Truffle Security

• 3,342 Leaked API Keys

  Discovered 3,342 active OpenAI API keys leaked in public repositories. Reported to OpenAI Security, who confirmed and revoked the keys.

  Mar 2026•OpenAI•$500

• Production Environment File Exposure

  Found a publicly exposed production environment file containing live AWS credentials with access to 57 S3 buckets, Auth0 management API tokens, and database credentials.

  Mar 2026•Pump•$2,000•Acknowledged by Pump