Summary
Cybersecurity researcher, open-source maintainer, and founder. Maintainer of GStack (129K GitHub stars) and GBrain (29K stars); 2nd-highest contributor to GBrain with 170 contributions. Reverse engineering of JavaScript and Swift / iOS applications, 10+ approved bug bounty disclosures, and consumer products with 30K+ App Store downloads.
Skills
- Specialty
- Reverse engineering of JavaScript and Swift / iOS applications · API tampering · auth bypass research
- Languages
- JavaScript, TypeScript, Swift, Python, Go, SQL, Bash
- Frameworks
- React, Next.js, Node.js, SwiftUI, UIKit, FastAPI, PostgreSQL, Supabase
- Security
- Burp Suite, Frida, mitmproxy, Charles, IDA / Ghidra, HackerOne
Open Source
GStack & GBrain — Maintainer · garrytan/gstack · garrytan/gbrain
2026 — Present
Garry Tan’s Claude Code toolkit (129K stars) and agent knowledge base (29K stars).
- Maintainer of both; 2nd-highest contributor to GBrain (170 contributions, 178 merged PRs) across sync, search, and CLI reliability.
- On GStack, 7 merged PRs including live-device iOS QA (tap, swipe, screenshot, state injection), upstreamed from a 1st-place YC hackathon project.
Hackathon Wins
GStack × GBrain Hackathon — 1st Place · Y Combinator
May 2026
- Built Claude Code skills for live iPhone QA, design review, and autonomous bug fixing; $5K prize, YC interview, and a 1:1 with Garry Tan. Project upstreamed into GStack.
Stanford Hackathon — Winner · GDG × Google × Red Bull
May 2026
- Placed among the winning teams at the Stanford GDG hackathon (90+ teams, judged by investors from Pear VC, Mayfield, Costanoa, Google DeepMind, and others).
Moss Hackathon — Winner · Moss × Y Combinator
Jun 2026
- Computer-use for iPhones at the Moss × YC Conversational AI Hackathon; featured in the official Moss recap.
Selected Disclosures
Hinge — Authorization bypass to premium features via API
2024 · Disclosed
- Found that the iOS client gated premium features in the UI but the backend would still process the underlying actions for non-paying accounts.
- Reverse-engineered the Swift client and replayed authenticated requests to demonstrate paywall bypass against premium-target profiles.
Wix.com — IDOR exposing user-scoped data
2024 · Disclosed
- Identified an insecure direct object reference where authenticated requests with another user's identifier returned scoped data without authorization checks.
Vibecodeapp — SSH authentication bypass (critical)
2024 · Disclosed
- Demonstrated an authentication bypass on the platform's SSH layer; coordinated disclosure with the team.
Experience
Tefillin Timer — Founder · iOS App
2024 — Present
Free iOS app helping observant Jews track tefillin practice with location-aware Zmanim and reminders.
- 30K+ App Store downloads; rewrote the app from JavaScript to native Swift for performance and notification reliability.
- Coverage in Jerusalem Post and i24 News.
Senior Support AI — Founder · Nonprofit
2024 — Present
Nonprofit teaching seniors how to use modern technology, with 10+ partner centers.
- Designed curriculum and on-the-ground programming serving 300+ seniors.
Independent Security Researcher — Self-employed
2023 — Present
- 10+ approved disclosures on HackerOne and direct programs across consumer and B2B platforms.
Webutation, Inc — Software Engineer Intern · Lead Dev on MVP
2022 — 2024
- Led MVP development end-to-end across full stack.
Education
New York University — B.A. Computer Science · CAS
2026 — 2029 · Admitted
Santa Monica College — Computer Science · 4.0 GPA
2025 — Present
Los Angeles Pierce College — Computer Science · 4.0 GPA
2025 — 2027
Calabasas High School — AP Computer Science A & Principles
2021 — 2025
Languages · Activities
Fluent English · Conversational Hebrew · Level 10 competitive gymnast · Varsity wrestler.