0x1RIS

Security used to be the 2AM hobby The thing I did when you slept - breaking web apps , mapping AD attack paths , writing exploits for fun Back then I followed curiosity until it turned obsession

I realized the backend is where you fight Now I build the systems I used to break , and that changes how I write code

My Journey

Alias 0x1RIS , I’m a backend engineer who came up through the offensive security trenches Started in web application pentesting when I should have done something else , wormed through Active Directory , fell into binary exploitation I spent years breaking systems on purpose to learn how they fail

I moved from security hobbyist to backend engineer after too long staring at other people’s vulnerabilities and thinking “I can build this better”

I exploited SQL injection , so I use parameterized queries without debate I studied buffer overflow , you learn memory safety no linter covers I mapped AD attack path , you watch authentication flows crumble under pressure and you learn fast

You break things for years , you learn how to build things that hold

What I Do

I build backend systems I build APIs and databases , I harden authentication flows I build with a security-first lens from the other side of the fence I ran the same attacks against production systems I ran against lab targets , I know where cracks form

Backend Engineering

I do Node.js and Next.js architecture , REST and GraphQL API design I model SQL and NoSQL databases , I harden authentication to hold under pressure I design systems to scale without opening attack surface

Security Engineering

I threat model in design , I embed secure-by-default architecture in code structure I harden auth flows to survive abuse , I validate input for intent

Automation & Tooling

I got tired of repeating the same recon steps so I automated them I built recon frameworks and payload generators , I built traffic tools from real pain

My Professional Creed

Methodology

I learn the system enough to find where it hurts before anyone else does

  1. Deep Understanding First - Before I write code I map threat model and data flow I mark trust boundaries You decide architecture without context , you guess and call it expertise

  2. Build for the Attack You Can’t See - You miss a vulnerability , an attacker walks in I design assuming the attacker knows my code better than I do

  3. Validate Without Mercy - You validate inputs and edge cases , you validate state transitions You stay paranoid , your systems survive production

  4. Ship What Survives - You pass code review , that means little You ship after you run penetration testing against it

Core Competencies

Web Application Security I test modern SPAs and REST and GraphQL APIs I test microservice meshes , you find dumb implementation mistakes in each attack surface

Mobile Application Security I do Android reverse engineering and APK analysis You intercept traffic and see what developers hid in client-side code

Network Security I run infrastructure penetration testing at scale , you move nmap past port scanning You use it as precision instrument

Cloud Security I audit AWS and Azure , I find configuration failures that let attackers walk in through S3 buckets and IAM misconfigs

Tool Development I build recon frameworks and payload generators You need custom exploitation tooling when off-the-shelf tools fail

Technical Arsenal

Programming I use Python for automation and exploitation , JavaScript and Node.js for web testing I use Bash for post-exploitation and system administration , Go for speed and concurrency I use C and C++ for reverse engineering and binary analysis

Security Tools I run Burp Suite Pro (when it doesn’t crash mid-scan) , Metasploit , Empire , Nmap , Masscan , Nessus , Ghidra , IDA Pro , Radare2 , SQLmap , Gobuster , Pwntools

Platforms I live in Linux - ParrotOS , Kali , Ubuntu I use Windows Server when targets demand it , I work cloud across AWS , Azure , GCP

Philosophy

Why Security-First Engineering Works

You introduce security issues before security review An architect picks a data model , an engineer picks an authentication library A developer writes the first route handler You embed security in each decision or you lose it

I saw the same vulnerabilities in codebase after codebase You skip the attack in a design choice

Work Ethic

  • Write code that survives production
  • Understand the system before you secure it
  • Automate boring shit , stay thorough
  • If I save hours with a tool , I open source it so you save hours
  • Attackers win with one hit , you defend each hit

Profiles

I do security research and engineering Check links for open-source projects and write ups , CTF profiles and professional work

I broke systems for years , I build them to hold

For business inquiries and security consulting , reach out through LinkedIn

You want technical talk or open-source collaboration , use GitHub issues and pull requests

You disclose a vulnerability , use encrypted communication

I do security consulting , architecture reviews , I mentor engineers who build systems that let them sleep

Let’s build things that survive