YouGina

About me

I am a software engineer and security researcher with a background spanning software development, cybersecurity, and ethical hacking.

Since 2009 I have worked on building and maintaining software, with a focus on creating robust solutions and integrating security into the development process.

Outside of development, I practise bug bounty hunting and vulnerability research, using source code analysis and hands-on testing to uncover security issues and understand their root causes. I believe in responsible disclosure, continuous learning, and sharing knowledge with the security community.

Understanding software

I enjoy digging into software to understand how it works under the hood. This means reading source code, tracing execution paths and exploring how different features interact. By understanding the design and implementation, I can identify potential weaknesses, unexpected behaviour and areas worth investigating further.

Finding vulnerabilities

My approach to bug bounty hunting is from both a white-box and black-box perspective. Combining source code analysis with hands-on testing allows me to investigate web applications, APIs and other attack surfaces from different angles. I focus on understanding the application's functionality, challenging its assumptions and finding vulnerabilities that have a real security impact.

Building software

More than fifteen years of writing and maintaining production software, most of it in small teams where the same person designs the schema, ships the feature and reads the support ticket the next morning. I care about code the next engineer can read, migrations that can be rolled back, and defaults that fail closed.

Find me on:

Hackerone

Intigriti

Detectify

Twitter

Github

How I work

Three habits show up in almost every finding I have made, and in most of the ones I missed.

Read the code

The quickest way to find a missing check is to read the query it should have been in. Tools find patterns; understanding finds causes.

Test the boundary

Almost every bug I have reported lived at an edge: a second tenant, a misbehaving token, the field that quietly accepts an prototype.

Write it down

If I cannot explain a bug in plain language, I do not understand it yet. Writing the report, or a blog article, is how I check that I do.

YouGina

Software engineer and security researcher. I write about bug bounty hunting, application security, and the craft of building software that is harder to break.

Explore

Home
About me
Blog

Get in touch

@yougina
For research questions, disclosure conversations, or a second opinion on something you are working through.