WEB SECURITY · WORDPRESS ENGINEERING · CONSULTING
PRAGMATIC SECURITY.
TECHNICAL SOLUTIONS
WITH THE BIGGER PICTURE IN MIND.
I test web applications from a realistic attacker’s perspective — focusing on relevant, practically exploitable vulnerabilities rather than theoretical findings. At the same time, I develop and extend existing systems where off-the-shelf solutions reach their limits — pragmatically, cleanly, and with the bigger picture in mind.
4000+
SCHWACHSTELLEN GEMELDET
1100+
NACH MELDUNG BEHOBEN
60k+
WEBSITES GEPRÜFT
15+
JAHRE WEBENTWICKLUNG & SECURITY
SECURITY THAT THINKS AHEAD
A FINDING IS ONLY THE BEGINNING.
A vulnerability is rarely just a single isolated flaw. What matters is understanding why it exists, assessing its impact, and fixing it sustainably. That’s how one-off fixes turn into improvements that prevent similar issues from recurring.
WEB SECURITY
Security testing for web applications and existing systems — from realistic black-box testing to targeted grey-box and white-box analysis.
WEB ENGINEERING
Developing and extending existing systems, especially where off-the-shelf solutions fall short or unusual requirements need to be implemented cleanly.
CONSULTING & SUPPORT
Making technical decisions together, communicating concepts clearly, and supporting teams with architecture, security, and implementation.
BLACK-BOX TESTING
Testing from an external attacker’s perspective — without internal knowledge and with a focus on what is actually possible through the publicly accessible application.
GREY-BOX & WHITE-BOX TESTING
With user access, technical context, or insight into code and configuration, permissions, business logic, and individual components can be examined more systematically and in greater depth.
SECURITY REVIEWS & RISK ANALYSIS
Existing penetration test reports, scanner findings, or individual vulnerabilities can be assessed from a technical perspective: What is actually exploitable? What impact is realistic? And what should be fixed first?
ARCHITECTURE & SECURITY DESIGN
Build security into architectural and technical decisions from the start — choosing appropriate safeguards, reducing attack surface, and developing solutions together with the engineering team.
WEB SECURITY
TEST WHAT AN ATTACK CAN ACTUALLY ACHIEVE.
Every finding is documented so developers can understand and reproduce it, while stakeholders can properly assess the risk. I also provide concrete guidance on how to fix it and — if needed — verify the fix afterwards.
WORDPRESS & WEB ENGINEERING
NOTHING IS IMPOSSIBLE — THE IMPOSSIBLE JUST TAKES LONGER.
I usually step in where an existing system runs into a specific requirement it cannot handle. WordPress is my main focus, but I’m equally comfortable getting into mature or unfamiliar codebases — from TYPO3 to Shopware. Often, there’s no need to start from scratch. What’s needed is a clean extension, a targeted patch, thorough debugging, or simply changing the right piece of the system.
Extend plugins and existing functionality in a targeted way — using hooks, APIs, or custom extensions without breaking the update path.
When a plugin or its documentation doesn’t provide for a particular feature, I find a clean way to implement it anyway.
I get up to speed with mature codebases, systematically narrow down problems, and fix the root cause rather than just the symptom.
Identify bottlenecks in PHP, WordPress, databases, or server infrastructure and optimize where time is actually being lost.
FOR AGENCIES & DEVELOPMENT TEAMS
BRING ME IN FOR THE SPECIAL CASES.
Not every edge case needs a new project or additional permanent capacity. I can step into existing projects for a limited time, get up to speed with the codebase and context, and take on the part that needs deeper security or engineering expertise. The goal is a pragmatic solution that fits cleanly into the existing system and can be maintained by the team without depending on me long-term.
EXPERIENCE & BACKGROUND
15+ YEARS OF DEVELOPMENT & SECURITY
I’ve been working with web development and security since my teens. What started as a hobby gradually became my profession.
The idea of “everyone has their own skills, everyone has their own needs” still shapes how I work today. For me, Responsible Disclosure is part of that in a very practical sense: if I find a vulnerability, I report it even when there is no bug bounty program — and I don’t make the report dependent on a reward.
RESPONSIBLE DISCLOSURE
When I find a vulnerability, I report it directly to the operator. My report includes the affected location, reproducible steps, a deliberately harmless proof of concept, and an assessment of the potential impact. If the root cause can already be narrowed down, I also include concrete guidance for fixing it.
After an update, I retest the original attack path. The report itself is not tied to either a reward or a follow-up engagement. If a company needs additional support afterwards, we discuss that separately.
PAY WHAT YOU WANT
I don’t ask for payment for unsolicited vulnerability reports. If a company would still like to thank me for a finding, they can decide for themselves what the report was worth to them.
For a small business, for example, I’ve issued an invoice for less than €25 before — simply because they wanted to say thank you. For a single vulnerability on a regular website, I often consider around €250 appropriate. If the finding affects a plugin, platform, or another component used by many customers, the scope is naturally different.
I deliberately don’t derive a fixed amount from that. More, less, or no payment at all is fine with me. For commissioned security testing and development work, scope and price are agreed in advance.
SECURITY RESEARCH IN PRACTICE
I document a large part of my independent security research through OpenBugBounty, where many of my reports and the fixes that followed are publicly available.
It doesn’t always stop with a single website. When multiple affected systems use the same software, plugin, or platform, I look for the common root cause and report it as close to the source as possible — where it can be fixed centrally.
PROBLEMS DON’T STOP AT TEAM BOUNDARIES.
Web applications don’t operate in isolation. Development, operations, and security all affect each other. My broad technical background helps me see these connections and trace problems across multiple layers of a system.
FROM THE BROWSER TO THE SERVER
Problems often surface somewhere other than where they originate. I trace them through frontend, backend, databases, and infrastructure until I reach the actual root cause.
THINK ABOUT CODE AND CONFIG TOGETHER
Secure code isn’t enough if permissions, server configuration, or deployment open up new attack paths. That’s why I look at the application and its environment as one system.
THINK BEYOND THE LAUNCH
Technical decisions continue to affect updates, deployment, maintenance, and security long after launch. For me, those consequences are part of the decision from the start.
BRIDGE TECHNICAL PERSPECTIVES
Developers, operations, and security teams look at the same system from different perspectives. I can bridge those perspectives and explain technical decisions in a way that gives everyone what they need to move forward.