Isaiah Reyes

Self-taught offensive security researcher seeking junior penetration tester or application security engineer roles. I build and break web applications, operate my own infrastructure, and document everything.

Olympia, WA · US Citizen · CompTIA Security+ in progress

At a Glance

#613

HTB Season 12

50+

Machines Rooted

HackerOne Reports

1,000+

Hours Training

Notable Work

Coordinated disclosure of a critical Apache RCE exposure (CVE-2021-41773 / CVE-2021-42013, CVSS 9.8) — identified nine customer-facing VPS instances at a major hosting provider running vulnerable Apache 2.4.49 through passive reconnaissance of public scan data. Traced the pattern to the provider's base image, reported through their security.txt contact with CVE references, remediation guidance, and a CERT escalation timeline. Acknowledged and remediated.

HackTheBox Professional rank, Level 58 — 50+ machine compromises across Windows and Linux, Easy through Insane difficulty. Season 9 finish #1740, Season 10 finish #1986, Season 12 currently #613 out of 5,400 active players. Consistent upward trajectory.

6 valid vulnerability reports through HackerOne in information disclosure, broken access control, and business logic categories.

Experience

Bug Bounty Hunter & Security Researcher Oct 2024 – Present

Web application pentesting, vulnerability assessment, OWASP Top 10, coordinated disclosure. Built and operate a dedicated OOB testing server with custom nginx logging and Python parsing tools.

Founder & Web Developer — Hardline WebWorks Sep 2026 – Present

Web application security assessments and vulnerability scans for small businesses. Build secure websites and AI assistants with guardrail and abuse testing.

Founder & Developer — The Photog Plan Jul 2026 – Present

Designed and shipped a live SaaS application solo: HTML/JS frontend, Node backend, Supabase with row-level security. Provision and administer the VPS end to end.

Skills

Security & Pentesting: Web application penetration testing, OWASP Top 10, business logic flaws, broken access control, injection, privilege escalation, Active Directory attack paths, responsible disclosure

Tools: Burp Suite, Nmap, Metasploit, BloodHound, Gobuster, ffuf, SQLmap, Hashcat, John the Ripper, Wireshark, Kali Linux

Systems: Linux (Ubuntu, Debian, Kali), Windows, nginx, DNS, TLS, SSH hardening, firewall configuration, VPS provisioning

Development: Bash, Python, JavaScript, PHP, Node, HTML/CSS, Git, PostgreSQL, SQL