roodlicht

Django security review — CSRF, ORM-level SQL injection (raw/extra/annotate), template injection via |safe, admin hardening, middleware ordering, settings deploy checklist, and recent Django CVE patterns.

Exploit-chain assembly methodology — combining multiple medium-impact findings into one high-impact path (Open Redirect + OAuth = ATO, SSRF + cloud-metadata = creds, IDOR + privilege escalation, prototype pollution + downstream gadget). Pattern-level, with chain-aware CVSS scoring and MITRE ATT&CK mapping.

Spring Boot security review — Spring Security config (SecurityFilterChain), OAuth2/OIDC client and resource-server, method-level @PreAuthorize, JWT validation, actuator endpoint lockdown, CSRF model for web vs API, and recent Spring CVE patterns (Spring4Shell, SpEL injection, authorization bypasses).

Software supply-chain defense — SBOM generation (CycloneDX/SPDX), SLSA build provenance, artifact signing with sigstore/cosign, dependency-confusion and typosquat defense, and consumer-side verification of what you pull in.

Pentest report builder — executive summary, methodology, finding template with CVSS v3.1/v4.0 scoring, reproduction steps, impact and remediation per finding, remediation roadmap, retest sign-off, and appendices. Works for web-app, network, red-team, and bug-bounty reports.

Digital-forensics assistant for IR context — memory analysis via Volatility 3, disk-imaging hygiene (write-blocker, hash validation), timeline reconstruction via plaso/log2timeline, file-system artifacts per OS. Audit-grade evidence; courtroom-grade chain of custody requires additional specialized forensics work.

Evidence collection and packaging for security audits — evidence types (inspection/observation/inquiry/re-performance/automated), cadence per control, chain of custody, period tagging, WORM storage and retention, auditor delivery. Usable for SOC 2, ISO 27001, NIS2, DORA, and internal audits.

Structured red-team pass over your own output — surface assumptions, gaps, failure modes and security red flags before shipping.

Web vulnerability triage — JWT flaws (alg confusion, none alg, kid injection), deserialization (Java/Python/PHP/Ruby/Node), prototype pollution, OAuth misconfigs (redirect_uri, PKCE, scope), CSRF, DOM XSS, SSRF. Classification, impact assessment at pattern level, and handoff to remediation.

Security review workflow for a PR, feature or codebase — scope, automated scans, manual OWASP/CWE pattern-check, prioritize and report. Uses secure-coding as pattern library.

SIEM query-builder workflow — Splunk SPL, Microsoft Sentinel/Defender KQL, Elastic EQL/KQL, with cross-translation patterns, performance tuning (data models, summary indexes, CCS), and query-by-detection-need. Source layer for detection-engineer, log-triage, and threat-hunt.

Pattern-level payload library for XSS, SSTI, LFI, SSRF, and command injection — context detection (HTML body/attribute/JS/CSS/URL), encoding-bypass shapes (URL/HTML/Unicode/double), polyglots, WAF-bypass patterns at syntax level. No version-specific weaponized exploits.