Independent security reviews
I break protocols
before attackers do.
Security researcher and systems engineer in Sweden. I audit smart contracts and web applications, and build the offensive tooling I test them with.
Independent · Sweden · fixed fee
Engagements
all services →Authorized, scoped security work for teams shipping smart contracts, Rust services or web apps. Fixed scope, fixed fee, real reports, responsible disclosure.
Smart contract audit
Fixed-fee review of Solidity and Rust protocol code, with proof of concept and fix verification.
Rust security audit
A fixed-scope review of unsafe code, FFI boundaries, panic paths and dependencies.
Web application penetration test
Authorized, scoped testing of a web app or API, end to end.
Security retainer
A monthly review window for teams that ship continuously.
How an engagement runs
the full process →- 01
Scope
Written scope, the commit under review, and rules of engagement. You get a fixed fee and a start date before anything is tested.
- 02
Test
Hands-on review of the code as it will ship. Every finding is reproduced against the commit under review, not a snapshot from memory.
- 03
Report
Severity-rated findings with proof, impact and a concrete fix. A coverage statement records what was reviewed and what was not.
- 04
Retest
I re-run every finding against your patch and mark it fixed, partially fixed or open. The fix is verified by me, not taken on trust.
Free tool
Check if your codebase is ready for an audit
Eight phases, a score out of 100, and the three things to fix before the clock starts.
Tooling
Built An intercepting proxy and scanner in one Rust binary
Proxy, scanner, repeater, intruder, race engine, and a self-hosted out-of-band server on eight protocols — plus an AI agent that drives all of it. One binary, on your machine, local-first and no account.
Community is free forever; Pro is a flat €10/month.
1.84M lines of Rust · one binary
HTTP/1 · 2 · 3 + WebSocket MITM
112 active + passive checks
Community free · Pro €10/mo
Compare
Weighing Hugin against Burp Suite, Caido or ZAP? Here is the honest, row-by-row breakdown — including where each
competitor wins.
Advisories
all advisories →Vulnerabilities I find and disclose responsibly — CVEs, advisories, bug-bounty work.
Local privilege escalation to root in macOS PackageKit
Impact An app could gain root privileges — full local compromise of the machine (read/modify any data, persist, disable protections).
Research
all research →Writeups on the bugs above, and articles on tooling, Rust, and method.
Approving a crypto licence on any Google Ads account
The Ads identity agent answered with no cookies and took the customer id out of the request body. Two curl calls, and the account shows an approved restricted certification it never qualified for.
The five ways DeFi protocols get drained
Most post-mortems describe the same five failure families: access control, accounting drift, oracle failure, liquidation assumptions and integrations. Here is what each one looks like in code.
Enterprise-grade, from scratch
1.8 million lines of Rust, one binary, a self-hosted OOB server, and an AI that writes its own exploits. Almost a year building Hugin to a high bar.
This is the endgame for Anthropic
Anthropic watermarks your Claude Code system prompt based on your timezone and proxy settings. I verified it in my own binary, v2.1.190.
Get Hugin
Self-serve
Hugin is built
The intercepting proxy and scanner I build and use daily — one Rust binary, local-first, no account. Community is free; Pro is €10/month when you need the offensive tier.