1. SUMMARY
I spent seven years as a software engineer, building Apps and the APIs in front of them. Now I break the same kind of systems for a living, as an offensive security researcher at NusaSec. 45+ CVEs published to date. Active on HackerOne, YesWeHack, Wordfence and Immunefi.
Having built them is the advantage. I know which checks get skipped under a deadline, which input gets trusted because "the frontend already validates it", and where a trust boundary is assumed rather than enforced.
2. HIGHLIGHTED ADVISORIES (full record: [1] advisories)
CVE-2026-1027399.1CRITICALEspectre
CVE-2026-730699.1CRITICALTwenty
CVE-2025-128518.1HIGHMy Auctions Allegro
CVE-2025-135168.1HIGHSureMail
CVE-2026-33597.5HIGHForm Maker by 10Web
3. EXPERIENCE
2024 - presentIndependent Security Researcher2021Sr. Python Developer, @ PT Nusa Network Prakarsa2019Software Engineer, @ PT Liburania Teknologi Internasional2018Jr. Python Developer, @ PT Sumihai Teknologi Indonesia
4. ORGANIZATIONS
2026-05 – presentNusaSec
4. CREDENTIALS
HackTheBoxCertified Web Exploitation SpecialistBadan Siber dan Sandi NegaraCertificate of Appreciation of BSSN
5. PROFILES
hackeronehackerone.com/type5afeintigrititype5afelinkedinlinkedin.com/in/m-indra-purnamaxx.com/1saac_laheyteamnusasec.orgmailhello@type5afe.ee
6. NOTE
Bored? [4] play has 4 real-world snippets. Find the vulnerable line in each.