Sina Matian

Independent Security Researcher · Founder · CS @ NYU

sina@sinamatian.com · sinamatian.com · github.com/time-attack · linkedin.com/in/sina-matian · Los Angeles, CA

Summary

Cybersecurity researcher and founder focused on reverse engineering of JavaScript and Swift / iOS applications. 10+ approved bug bounty disclosures at Hinge, Wix, and Vibecodeapp, and shipping consumer products that have reached 30K+ App Store downloads. Building things that work for real people while finding what others ship by accident.

Skills

Specialty: Reverse engineering of JavaScript and Swift / iOS applications · API tampering · auth bypass research
Languages: JavaScript, TypeScript, Swift, Python, Go, SQL, Bash
Frameworks: React, Next.js, Node.js, SwiftUI, UIKit, FastAPI, PostgreSQL, Supabase
Security: Burp Suite, Frida, mitmproxy, Charles, IDA / Ghidra, HackerOne

Selected Disclosures

Hinge — Authorization bypass to premium features via API

2024 · Disclosed

Found that the iOS client gated premium features in the UI but the backend would still process the underlying actions for non-paying accounts.
Reverse-engineered the Swift client and replayed authenticated requests to demonstrate paywall bypass against premium-target profiles.

Wix.com — IDOR exposing user-scoped data

2024 · Disclosed

Identified an insecure direct object reference where authenticated requests with another user's identifier returned scoped data without authorization checks.

Vibecodeapp — SSH authentication bypass (critical)

2024 · Disclosed

Demonstrated an authentication bypass on the platform's SSH layer; coordinated disclosure with the team.

Experience

Tefillin Timer — Founder · iOS App

2024 — Present

Free iOS app helping observant Jews track tefillin practice with location-aware Zmanim and reminders.

30K+ App Store downloads; rewrote the app from JavaScript to native Swift for performance and notification reliability.
Coverage in Jerusalem Post and i24 News.

Senior Support AI — Founder · Nonprofit

2024 — Present

Nonprofit teaching seniors how to use modern technology, with 10+ partner centers.

Designed curriculum and on-the-ground programming serving 300+ seniors.

Independent Security Researcher — Self-employed

2023 — Present

10+ approved disclosures on HackerOne and direct programs across consumer and B2B platforms.

Webutation, Inc — Software Engineer Intern · Lead Dev on MVP

2022 — 2024

Led MVP development end-to-end across full stack.

Education

New York University — B.A. Computer Science · CAS

2026 — 2029 · Admitted

Santa Monica College — Computer Science · 4.0 GPA

2025 — Present

Los Angeles Pierce College — Computer Science · 4.0 GPA

2025 — 2027

Calabasas High School — AP Computer Science A & Principles

2021 — 2025

Press

Jerusalem Post — "Young developer builds Tefillin timer app" i24 News Interview (YouTube)

Languages · Activities

Fluent English · Conversational Hebrew · Level 10 competitive gymnast · Varsity wrestler.