Aldan Bran

Security researcher and bug bounty hunter specializing in business logic flaws, broken access control, and authorization bypass vulnerabilities in web applications and APIs. Track record of 4 paid vulnerability disclosures, 30+ valid findings, and recognition in 5 corporate Hall of Fame programs, including high-severity findings in SAML/SSO, JWT scope bypass, rate limiting, and IDOR/BOLA. Experienced in manual API testing, authorization boundary analysis, and delivering clear proof-of-concept reports under responsible disclosure practices.

And Im still learning

Independent Security Researcher at Self-Employed (2025-12 – Present)

Conduct independent security research focused on business logic flaws and access control issues in web applications.

• Identify and responsibly disclose vulnerabilities such as IDOR, Broken Access Control, Privilege Escalation, and Authorization Bypass
• Test application logic for improper state transitions, race conditions, and insecure role handling
• Assess user data isolation and authorization boundaries across multi-user workflows
• Evaluate authentication and account security mechanisms, including 2FA bypass scenarios
• Analyze file upload and content handling issues leading to phishing or security abuse
• Submit clear proof-of-concept reports following responsible disclosure practices
• Contributed to validated high-impact security findings acknowledged by security teams

Game Tester / QA Tester at Verly Gamedev (2021-03 – 2025-09)

Full-Stack Developer at Sentra Abiyoso (2020-07 – 2020-09)

Skills: PHP, HTML

Full-Stack Developer (Intern) at OCBC (2019-05 – 2019-08)

Skills: PHP, HTML