about

I'm a penetration tester on Temika Cyber's Red Team, based in Bandung, Indonesia — web, mobile, and infrastructure assessments against the OWASP WSTG and MASTG, with remediation retesting to confirm fixes actually hold.

My route here wasn't the usual one. I built mobile and backend applications first — Flutter, Dart, Node.js, Firebase, on-device ML — so I read applications from the inside out: how they're wired, where trust boundaries get assumed instead of enforced, and which "impossible" states nobody tested.

That builder's instinct is what I now point at access control, authentication, and business logic. I found and responsibly disclosed a Critical (P1) account-takeover chain in a production university portal, won first place at a national cybersecurity CTF, and reached Professional rank (Top 5%) on Hack The Box Academy. I still run CTFs and bug bounty outside work.

how I got here

1. 2022 – 2026
   Computer Science @ USU — and shipping apps

   B.Sc. Computer Science (GPA 3.96/4.00). Backend Development Trainee at IDCamp (Node.js REST APIs, auth). Built and shipped multiple Flutter apps — the build background that now informs how I test.

2. 2024 – 2025
   Security-curious → hands-on, and teaching

   Networking and offensive fundamentals: Cisco Networking Academy, TryHackMe (47 rooms, Top 15%), LetsDefend (SOC/blue-team). Served as Computer Networking Lab Coordinator at IKLC/USU — teaching TCP/IP, subnetting, and Wireshark traffic analysis to 20+ students per class.

3. Jan 2025 – present
   Hack The Box Academy — Professional, Top 5%

   Self-driven offensive training: SQLi, XSS, file upload, command injection, broken auth, session security, GraphQL, ffuf enumeration — plus defensive modules (SIEM, Windows event logs, forensics). From Jan 2026, the Hextree Android security path (JADX, APKTool, Frida).

4. Aug 2025
   1st place — national cybersecurity CTF

   First place at "Siber Tangguh Bangsa Merdeka" 2025, a team-based CTF focused on web security and attack-surface exploration.

5. Mar 2026
   Critical (P1) account-takeover disclosure

   Discovered and responsibly disclosed a Critical account-takeover on a USU production student portal via chained IDOR + broken access control, with a Burp Suite proof-of-concept. Received an official Certificate of Appreciation from PSI USU.

6. Aug 2026 – present
   Junior Penetration Tester @ Temika Cyber

   Joined Temika Cyber (PT Teknologi Integrasi Informatika) on the Red Team: professional web, mobile, and infrastructure penetration testing under NDA.

experience

disclosed findings & wins

training platforms

public profiles — no re-hosted platform badges

certificates & badges

tools & methodology

mobile development

the build background — a differentiator, not the headline. each opens a detail page.

Aletheia Food

Reveal food truth with on-device ML. Personal project · Flutter + on-device ML open ./aletheia-food →

Smritive

Preserve and share your story memories. Dicoding Intermediate Flutter submission · built to production quality open ./smritive →

Anime Verse

Anime discovery and tracking. Built for the IKLC Mobile Programming teaching course (8 modules) open ./anime-verse →

NyamNyam

Restaurant discovery, done cleanly. Dicoding Fundamental Flutter submission · refined as a portfolio piece open ./nyamnyam →

education

contact