I build and secure cloud infrastructure with code.
Security-as-code across AWS and Azure — least-privilege identity, network segmentation, secrets management, and security scanning wired into CI so nothing insecure ships. I came up through offensive security research: I already know how attackers find and exploit bugs — now I build the controls that stop them.
I design and run cloud infrastructure the secure way: least-privilege identity, private data services, encryption and secrets in a vault, and automated security checks on every change. I write it as Terraform so it is reviewable and repeatable, and I send logs to one place and write detections against them.
My foundation is offensive security research — five assigned CVEs and valid bug bounty findings, mostly broken access control, IDOR, privilege escalation and authentication flaws. Three of my five CVEs are access-control failures: the exact class of mistake that produces over-broad cloud IAM roles and trust boundaries that aren't really enforced. Finding these from the outside is why the infrastructure I build starts from least privilege and explicit deny.
Strongest on AWS, Terraform, Docker and Kubernetes, and working across Azure identity and Microsoft Sentinel.
Every project has public code and CI on GitHub — real output, nothing estimated.
Secure document platform on AWS, built the way a small company would: one web server, a private database, secrets in a vault, everything in Terraform, security scanning in CI.
Two Dockerfiles for the same app — weak vs hardened — with real Trivy and Hadolint results for both. A documented before/after case study.
A real cluster, an insecure workload, and two independent admission-control layers tested against it — actual kubectl output, not a diagram.
Failed Login Detector — groups failed logins by source IP and alerts on a threshold (MITRE ATT&CK T1110). File Integrity Monitor — SHA-256 baselines with change severity. Both tested in CI.
I find and report vulnerabilities through bug bounty programs and coordinated disclosure. Most are access-control and authentication flaws. Five have been assigned CVEs with public GitHub Security Advisories; others were rewarded under private disclosure terms.
| CVE | Severity | Class | Summary | Advisory |
|---|---|---|---|---|
| CVE-2026-73407 | Critical | Authentication | REST datasource credential theft via cross-origin auth leak | GHSA ↗ |
| CVE-2026-25040 | Critical | Access control | Creator role can invite users with Admin or any role | GHSA ↗ |
| CVE-2026-25045 | Critical | Access control | Missing RBAC — privilege escalation and IDOR in role management | GHSA ↗ |
| CVE-2026-73409 | High | Server-side | Filesystem read oracle via builder-controlled MongoDB cert path | GHSA ↗ |
| CVE-2026-25043 | Medium | Rate limiting | Unauthenticated password-reset endpoint with no rate limiting | GHSA ↗ |
read-only / app_view role performs admin & owner-level operations via API. Rewarded as a goodwill bounty under coordinated disclosure.
Report available on request →Creator-level user invites users with Admin / any role via API, bypassing UI restrictions. One of several findings on the platform (see CVEs above).
Report available on request →Organization takeover via stale session reuse — session tokens not invalidated after a user is removed. Confirmed and fixed by the vendor.
Report available on request →SSRF via OAuth jwks_uri in dynamic client registration — internal metadata & Hydra admin API reachable. Confirmed and fixed.
Multiple broken-access-control and privilege-escalation findings across the platform, rewarded under coordinated disclosure.
Report available on request →Member/Viewer role performs admin-restricted actions via API and GraphQL. Reported through a managed engagement; vendor name withheld under program terms.
Details on request →SSRF in webhook URL validation — internal network probing & metadata reachability. Triaged High; vendor name withheld under program terms.
Details on request →Business-logic and race-condition findings on a web3 platform, plus an unauthenticated OAuth-overwrite account-takeover class issue elsewhere. Accepted; disclosed privately.
Details on request →Full write-ups for privately disclosed findings are shared on request, subject to each program's disclosure terms. Reach out at manhasino@gmail.com.
#53 in Nigeria all-time · 262 rooms across Linux, networking, web & API security, enumeration and privilege escalation · Advent of Cyber 2024.
Hands-on exploitation practice across retired and active boxes — enumeration, foothold and privilege escalation.
Jeopardy-style challenges across web, binary, forensics and cryptography categories.
Microsoft
Amazon Web Services
IBM
University of the People · in progress
Open to Cloud Security and DevSecOps roles. For private report details or anything else, reach out directly.
manhasino@gmail.com