Web developer & security researcher

Projects

• oss-oopssec-store

  Security training for the apps you actually ship. Open your browser and start hacking.

• cyber-bot

  Threat intelligence platform: RSS aggregation, NVD CVE tracking, ENISA EUVD, databreaches, ...

• hate-crimes-map

  This project aims to visualize hate crime data to bring visibility to crimes that are often invisible or normalized by society.

• crack-hash

  A fast, multi-threaded hash cracking tool written in Rust. This tool performs dictionary attacks against hashed passwords.

• awesome-pentest-tools

  Open-source offensive security tools, plus a vendor-agnostic AI agent that runs authorized pentest engagements using only tools from this list.

CVEs reported

• CVE-2026-32255High · 8.6Mar 2026

  Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).

  github.comgithub.comgithub.com

Public PoCs

• CVE-2026-32255

  This repository contains a proof of concept (POC) for CVE-2026-32255, a high-severity Server-Side Request Forgery (SSRF) vulnerability in Kan, an open-source project management tool.

• CVE-2025-55182

  This repository contains a POC of CVE-2025-55182, a critical (CVSS score 10.0) pre-authentication remote code execution vulnerability affecting React Server Components, also known as React2Shell.

• CVE-2025-29927

  This repository contains a POC and an exploit script for CVE-2025-29927, a critical vulnerability in Next.js that allows attackers to bypass authorization checks implemented in middleware.

Open-source contributions

• qazbnm456/awesome-web-securityPython13.6k★

  🐶 A curated list of Web Security materials and resources.

• kanbn/kanTypeScript5.1k★

  The open source Trello alternative.

• beelzebub-labs/beelzebubGo2.1k★

  A secure low code deception runtime framework, leveraging AI for System Virtualization.

• OWASP/www-communityHTML1.4k★

  OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.

• OWASP/www-project-vulnerable-web-applications-directoryHTML87★

  The OWASP Vulnerable Web Applications Directory Project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

• nilbuild/developer-roadmapTypeScript360.3k★

  Interactive roadmaps, guides and other educational content to help developers grow in their careers.

• usebruno/brunoJavaScript45.5k★

  Opensource IDE For Exploring and Testing API's (lightweight alternative to Postman/Insomnia)

• infoslack/awesome-web-hacking7k★

  A list of web application security

• satnaing/astro-paperAstro4.8k★

  A minimal, accessible and SEO-friendly Astro blog theme.

• husnainfareed/awesome-ethical-hacking-resources3.6k★

  😎 🔗 Awesome list about all kinds of resources for learning Ethical Hacking and Penetration Testing.

• lingdojo/kana-dojoTypeScript2.9k★

  Aesthetic, minimalist platform for learning Japanese inspired by Duolingo and Monkeytype, built with Next.js and sponsored by Vercel. Beginner-friendly with plenty of good first issues - all contributions are welcome!

• fabionoth/awesome-cyber-security1.9k★

  A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.

• vavkamil/awesome-vulnerable-apps1.4k★

  Awesome Vulnerable Applications

• kaiiyer/awesome-vulnerable1.4k★

  A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB.

• Grafikart/Grafikart.frPHP689★

  Dépôt pour la nouvelle version de Grafikart.fr

• okhosting/awesome-cyber-security636★

  A curated list of cyber security resources and tools.

• noraj/rawsec-cybersecurity-inventoryJavaScript342★

  An inventory of tools and resources about CyberSecurity that aims to help people to find everything related to CyberSecurity.

• secnotes/awesome-cybersecurityPython74★

  A collection of awesome github repositories about security

Writing

• MCP Tool PoisoningOWASPMar 2026

  MCP Tool Poisoning is an indirect prompt injection attack targeting AI agents that connect to external tool servers via the Model Context Protocol (MCP).

Tools & technologies

Programming Languages

JavaScript, TypeScript, Python, PHP, Ruby

Web Frameworks

React, Next.js, Node.js, FastAPI, Ruby on Rails, Symfony, Hapi.js

Security

Vulnerability Research, CVE Analysis, CTF Challenges, Web Application Security

DevOps & Tools

Git, CI/CD, Docker, Linux, Shell Scripting

Experience

• Full-Stack Web Developer·HardloopRemoteFeb 2018 – Jun 2026
  • Built and maintained the e-commerce platform and internal business tools
  • Helped drive a year-long ERP migration with zero-downtime deployment strategies
  • Set up CI/CD pipelines and deployment automation
  • Applied security best practices across the software development lifecycle
• Web Development Mentor·OpenClassroomsRemoteMar 2021 – Present
  • Mentor students through web development projects, teaching professional best practices
  • Conduct code reviews and provide architectural guidance

Education

• Professional Title·Web Development2016–2017

  IESA Multimedia

  Full-stack web development and software architecture.

• Master 1·Social Law2013–2014

  Jean Moulin Lyon 3 University

  Graduated with honors. Legal foundation relevant to compliance and incident response.

• Bachelor's Degree·Law2009–2013

  Jean Moulin Lyon 3 University

Certificate archive