Results for “security”

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.

The English summary is being prepared. Showing the original description.

Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that enables security testers to interact with app internals without jailbreaking. Use when assessing iOS app security posture, bypassing client-side protections, dumping keychain items, inspecting filesystem storage, and evaluating runtime behavior. Activates for requests involving iOS security testing, Objection runtime analysis, Frida-based iOS assessment, or mobile runtime exploration.

The English summary is being prepared. Showing the original description.

Assess OpenClaw security reports against released versions and documented trust boundaries, which define trusted users and components. Gather evidence to recommend closing, keeping open, or narrowing a report, and draft a maintainer response.

• Assessing an OpenClaw security report
• Checking whether released versions contain a reported bug
• Comparing a report with existing advisories

Implement and review security measures in Quarkus applications. Covers sign-in, access permissions, input validation, password hashing, secret storage, request limits, audit logs, and checks for known vulnerabilities in dependencies, with implementation and configuration examples.

• Adding JWT or OIDC authentication to a Quarkus API
• Checking role permissions and resource ownership
• Reviewing input validation and database queries

Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.

• Testing an API from its specification
• Checking data access across tenants
• Verifying restrictions on administrator routes

Set up Strix security checks in CI/CD to test pull request changes, report verified vulnerabilities, and gate merges. Covers both a CLI running on your own infrastructure and a managed service with pull request comments.

• Check pull request changes for vulnerabilities before merging
• Add Strix scans to GitHub Actions or GitLab CI
• Choose between managed reviews and scans on your own runners

Identify security threats in system designs using STRIDE, a method covering six threat categories. Use structured questions to review components, prioritize threats by impact, and document findings and possible safeguards.

• Start a threat modeling session
• Review the security of an existing system design
• Document threats and possible safeguards

Review and write Solidity smart contracts with security in mind. Address reentrancy, where external calls trigger repeated execution, along with numeric overflow and access control issues, using implementation patterns, security tests, and documentation for audit preparation.

• Review existing smart contracts for vulnerabilities
• Implement withdrawal logic that resists reentrancy
• Test overflow protection and access restrictions

Review source code for MCP, a protocol connecting AI applications to tools. Check authentication, input validation, unsafe execution, and other security risks, then report findings with file and line references and separate manual follow-ups.

• Reviewing an MCP server before release
• Checking authentication and validation on a network-exposed server
• Auditing tool code for unsafe execution paths

Check security audit findings against code evidence and trace how untrusted input moves through a system. Guide a second review, document verification gaps, and assess draft reports against a minimum quality score before delivery.

• Verifying evidence behind security review findings
• Rechecking input flows after an initial analysis
• Assessing report quality before delivery

Set up Zeek to observe network traffic and produce structured logs for security analysis. Create custom detection scripts, investigate suspicious DNS activity and repeated external connections, and forward logs to a central security monitoring system.

• Set up passive monitoring at key network points
• Create detection scripts for suspicious DNS and repeated connections
• Forward Zeek logs to a central security monitoring system

Build detection rules for suspicious Windows scheduled tasks by correlating Sysmon and Windows Security logs. Examine parent processes, file paths, encoded commands, and remote task creation to uncover persistent access and movement between systems.

• Investigating suspicious scheduled task creation
• Hunting for tasks that run encoded commands
• Detecting remote task creation across systems

Investigate phishing emails that hide malicious links in QR codes. Decode destinations, analyze suspicious URLs, configure email detection rules, and plan mobile protections and awareness training for people who scan codes on their phones.

• Investigating suspicious emails containing QR codes
• Configuring QR detection for email images and PDF attachments
• Protecting phones from malicious QR destinations

Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.

• Reviewing GitHub Actions workflow security
• Checking action version pinning
• Finding unsafe event expressions in scripts

Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.

• Hunting for suspicious PowerShell execution
• Investigating endpoint and security log alerts
• Assessing the scope of a PowerShell-related incident

Examine Windows endpoint logs for attempts to avoid security detection, including log clearing, altered file timestamps, injected code, and disabled protection. Correlate events to investigate suspicious behavior and develop detection rules with context for legitimate activity.

• Investigating cleared logs and altered file timestamps
• Checking suspected attempts to disable security tools
• Finding abuse of legitimate Windows utilities

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Identify runtime signs of attackers breaking out of Docker or Kubernetes containers. Review namespace changes, privilege abuse, sensitive host access, and unusual system calls to guide incident investigations and compare monitoring coverage across security tools.

• Investigating a suspected Docker or Kubernetes container escape
• Choosing runtime behaviors to monitor for escape attempts
• Comparing escape detection coverage across security sensors

Assess authorized networks through host discovery, service checks, vulnerability identification, and controlled exploitation. Follow a structured testing process to document attack paths, demonstrate business impact, clean up test artifacts, and prioritize remediation.

• Assessing internal or external network security
• Validating firewall rules and network segmentation
• Verifying whether service vulnerabilities are exploitable

Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.

• Add automated security scans to .gitlab-ci.yml
• Check dependencies and container images for known vulnerabilities
• Detect credentials and API keys committed to source control

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Assess the security of RAG systems, which retrieve documents to support AI answers. Test whether stored vectors expose source text, leak documents between tenants, or allow inserted content to dominate search results, then document findings and controls.

• Assessing source-text exposure from stored vectors
• Checking data isolation between tenants
• Testing retrieval manipulation in a test collection

Test iOS apps while they run using Objection and Frida, tools for inspecting and changing runtime behavior. Examine stored credentials, files, memory, and authentication calls, and evaluate client-side protections during authorized security assessments.

• Check stored iOS app data for sensitive information
• Inspect HTTPS traffic during authorized testing
• Observe authentication behavior without source code

Review security across web apps, APIs, mobile apps, Kubernetes, and AI agents using six OWASP references. Identify risky authentication, access controls, configurations, and prompt handling, then use examples and checklists to plan fixes.

• Review login flows and access controls
• Check API authorization and data exposure
• Review mobile app storage and communications