April 2026 to present
Security research across web applications, enterprise software, and Google Cloud.
$20,000 in bounties. Top 15 in Keeper Security’s Hall of Fame. Member of the Google VRP Hall of Fame. More than 30 vulnerabilities reported across 4 programs.
Found an authorization issue in Google Cloud Backup and DR. A user could add another project in the same organization to their own backup policy without permission on that project. The next scheduled backup copied that project’s disk into the user’s backup vault. The user then restored the disk and read its files.
Google triaged the report one day after submission and accepted it.
Fixed a SQL injection issue in an automated database password management service. The issue allowed an unauthorized password change on a separate database account, leading to account takeover. The fix separated user-controlled values from database commands.
Fixed an authorization issue that allowed non-admin record editors to reach a privileged execution feature. The issue led to code execution in the backend service. The fix restored the required permission checks.
Fixed a device approval bypass in the biometric/passkey login flow. An affected request could skip device approval and proceed to authentication. Authentication, MFA, biometric checks, and brute-force protection remained enforced.
Keeper released the fix in Backend API 18.1.0 within 24 hours of validating the report and publicly credited Karl Seryani.
Validated a high-severity stored XSS issue in NASA’s GLOBE platform that led to an authenticated session for another account. The report remains unresolved.
Research
AI security tooling
April 2026 to present
A multi-agent workflow that finds cloud vulnerabilities and tries to disprove them.
The workflow maps cloud APIs, runs tests, and challenges every positive result. It turned more than 1,500 test ideas into 11 Google Cloud vulnerability reports. Google triaged 3 reports and accepted 1.
A critic agent must fail to disprove each finding before the finding goes into a report. The researcher, hunter, and critic roles each run on a separate AI model.
A SQLite database stores each finding and test idea under a unique ID. The agents ask the database for only the data they need. This replaced a large Markdown file, so each run uses fewer tokens and costs less.
A Python request tool checks every request against a 220-rule host allowlist. It blocks out-of-scope and duplicate tests and saves more than 3,100 experiments as proof that anyone can replay.
Built with Python, SQLite, and Claude Code.
AI security case study
April 2026
How an assistant handled an unverified lab claim.
A documented conversation about an invented security exercise, followed by AI-assisted PDF manipulation and a separate résumé evaluation.
The case study examines what the screenshots support, what remains untested, and how a controlled follow-up could separate the effects.
One personalized Claude conversation, synthetic documents, and selected screenshots. The article distinguishes acceptance of the lab pretext from the evaluator's response to fabricated experience.
No real hiring system was tested. The experiment does not establish causation, success rates, or a ranking of models.
Open source contributor
Three merged contributions to a widely used web security scanner: example alerts and tests for three scan rules, plus simpler alert-building code.
SOC Analyst
January to April 2025
Built a Python integration between Wazuh and the Jira REST API. It creates a Jira ticket for each high-severity alert, with the alert severity and a short summary. This removed manual ticket entry.
Configured Wazuh firewall rules to block malicious IP addresses on monitored endpoints. Analyzed suspicious attachments in VirusTotal, ANY.RUN, and Hybrid Analysis to confirm malware.
Computer science graduate from Western University, with work spanning web security and software development.
Graduated in April 2026 with two Dean’s Honour List recognitions. Earned the HTB Certified Web Exploitation Specialist certification in July 2026.
Read my resume