Responsible disclosure. Found and disclosed a promo bruteforce at HeyGen — free 3-month Premium codes could be enumerated via script to mint accounts. Reported directly before any misuse. Rewarded for disclosure, not exploitation. The fix shipped, the report stayed private.
A hard lesson. Later, reverse-engineered a hardened anime streaming API with Frida and rooted AVD, built Donghuax to 170k users on a MongoDB cache. When the dev patched and the remaining data kept serving, the line became clear. Shut it down, owned the mistake. Useful technique, wrong application.
Since then, I build systems that respect the boundaries they test.
Built in public — last 31 days
| Project | Stack | Signal |
|---|---|---|
| K-12-reverse — bulk ChatGPT account automation with K12 invite & IMAP | Go |
  |
| Fable5res — 4,665 Fable 5 traces distilled, Grade A emulation vs MiniMax M3 | JavaScript |
  |
| deepseek-harness — fork, plugin harness | — |
 |
| ahmdd4vd — this profile | — |
 |
ahmd4vd