> STARTUPS_
Founders I build with and communities I build in — from AI and Web3 products to the Amsterdam builder scene, plus the odd security bug I stumble into along the way.
> COMMUNITY_
> SECURITY_RESEARCH_
Root AWS credentials via LFI
in2events · Responsibly disclosed → patched
My favourite find: a Local File Inclusion bug that I walked all the way up to full root AWS credentials. Reported it, they fixed it, nobody got hurt.
SSH authentication vulnerability
boxd.sh · Responsibly disclosed
Found and reported a vulnerability in their SSH setup.






