About FEKOJEWAN
Independent Bug Bounty Hunter and Security Researcher with a primary focus on Web Application Security and API Security architectures.
Security Philosophy
Modern software systems rarely fail due to missing syntax or primitive oversights; they fail because of broken assumptions made during architecture and integration. When microservices scale and developers prioritize velocity, the implicit boundaries between services often become permeable.
My research focuses on understanding the exact intent of developers, mapping the actual data pathways, and rigorously testing edge scenarios where authentication, authorization, or state synchronization deviate from intended design.
The ultimate goal of security research is not exploitation, but clarity: providing engineering teams with deterministic evidence, actionable remediation advice, and an architectural perspective that prevents recurring failure modes.
Responsible Disclosure Policy
Every vulnerability research activity is conducted strictly within authorized scope under coordinated vulnerability disclosure standards:
Never access, alter, exfiltrate, or delete user data beyond demonstrating minimal proof of concept.
Never disrupt system availability or perform automated volumetric denial of service testing.
Submit comprehensive reports containing detailed technical impacts and clear reproduction steps directly to authorized security contacts.
Maintain strict confidentiality until coordinated fixes are deployed and program teams authorize technical publication.
Research Interests
Broken Object Level Authorization (BOLA)
Multi-tenant isolation and API tenant leakage.Complex Business Logic & TOCTOU
Concurrency desynchronization in ledger & state machines.Federated GraphQL Subgraphs
Entity resolver authorization and schema boundaries.Server-Side Request Handling
Second-order SSRF in asynchronous worker pipelines.Authentication State Traps
OAuth dynamic callback desync and JWT token confusion.Verified Engagements
FEKOJEWAN works with engineering teams, bug bounty programs, and organizations to test and validate mission-critical Web and API attack surfaces.
Submit Authorized Scope