Security Researcher · Application Security · Web & API Security

I am an Offensive Security researcher based in Rio de Janeiro, Brazil. I break and secure web applications and APIs, reading through PHP, C#, and JavaScript codebases to find what automated scanners miss — authentication flaws, business logic abuse, and the browser and network layers underneath modern web apps.

Alongside my day job, I run offensive security research and practical write-ups through 0xDelta Research. I care about work that leaves reviewable evidence: proof-of-concept findings and responsible disclosure reports.

Security Researcher, 0xDelta Research — 2025–present

Contribute web and API security research and technical write-ups at 0xDelta Research, a community of security researchers covering Red Team, Blue Team, and Threat Intelligence. Focus areas: access control vulnerabilities, API security, and responsible disclosure.

Infrastructure Analyst, Bellinzoni Brasil — May 2025–present

Administer and harden network infrastructure, systems, and access permissions; keep core services (TCP/IP, DNS, DHCP, VLANs) and Windows Server/Active Directory environments running and patched.

Previously a .NET Developer at Programador.TV, building RESTful Web APIs with .NET Core/C#.

0xDelta Research — offensive security research and write-ups. Profile: serros404

Latest reports:

• Dissecting IDOR: When Hidden Resources Are Still Accessible Through the API — a practical breakdown of Insecure Direct Object Reference covering theory, a real-world private-album API case study, comparison with disclosed reports from Mozilla and Shopify, and detection/mitigation strategies.
• Critical 10.0: Full BI Infrastructure Compromise via Default Credentials — how a factory-default admin:admin login on an exposed MicroStrategy Library panel led to full takeover of a Business Intelligence environment, triaged as CVSS 10.0.
• Abusing WhatsApp Desktop for Initial Access: Python ZipApp Reverse Shell — a technical breakdown of using .pyz files to bypass protections and establish a reverse shell via WhatsApp Desktop.

• Bachelor's in Computer Science, UNINTER Centro Universitário Internacional — Oct. 2025–Oct. 2029

Rio de Janeiro, Brazil