Independent offensive security
Security for the
applications
you depend on.
Hands-on testing of your web applications, APIs, and mobile products. Understand what can go wrong, see the evidence, and give your team a clear path to a fix.
Website Services / Local businesses
A website that
works for your business.
New websites, redesigns, and migrations for irrigation contractors, trades, and other local service businesses. Help customers understand what you do, where you work, and how to get in touch. Based in Blaine, Minnesota, with remote support available.
Explore website servicesBuild or redesign your website
Start from scratch or improve an outdated site with clear services and easy ways to contact you.
Move from your current platform
Plan the pages, forms, domain, and hosting handoff before making the move.
Add WordPress care if you need it
Optional update checks, monitoring for malicious activity, and backups. Repairs are billed separately.
Fix a hacked or broken site
Separately scoped repairs for WordPress issues, failed updates, redirects, or broken functionality.
Recover access & ownership
A separate recovery project for domain, hosting, and website accounts you own.
Research & responsible disclosure
Organizations I’ve helped secure.
Through Garrett’s bug bounty, vulnerability disclosure, and responsible disclosure work.
Names identify disclosure work. They do not imply endorsement, affiliation, or a customer relationship.
Security Testing / Authorized engagements
Know where your
product is exposed.
Before a launch, after a major change, or when a specific concern needs investigation. Each review is scoped to your system and the decisions your team needs to make.
Web applications & APIs
Understand how authentication, permissions, and business logic hold up across real user roles.
02Mobile applications
Review the Android or iOS client alongside its APIs, identity systems, and connected workflows.
03Network & cloud exposure
Establish what is reachable, which exposures matter, and what your team should address first.
Selected public research
Read the work.
Published cases show how I investigate a problem, establish its impact, and communicate it responsibly.
One comment.
Two trust boundaries.
How an input in NASA GLOBE Observer reached a public web renderer, and how the issue was documented through responsible disclosure.
Following a file
beyond the upload.
A disclosure-safe account of a plain-text upload that crossed into a browser rendering context further along the workflow.
What you can expect
A clear scope.
Evidence you can use.
You work directly with the person doing the testing. Targets, access, timing, and deliverables are agreed before the engagement begins.
- 01 / Scope
Start with your priorities.
Agree on the systems, roles, and questions that matter, with written authorization and practical testing safeguards.
- 02 / Investigate
See what was confirmed.
Get reproducible findings, affected workflows, demonstrated impact, and remediation guidance your developers can act on.
- 03 / Resolve
Plan the next step.
Review the findings together. Fix verification and follow-up testing are defined in the proposal so the scope is clear.
Start a conversation
What do you
want to work on?
Tell me about your website project or security concern, what you need help with, and your timeline. I’ll reply directly about fit and next steps.
[email protected]Occasional field notes.
New research and practical guidance, with email confirmation before subscribing.