DDSec

Independent security research, by permission.

DDSec is the Sydney practice of David Duong. I find and responsibly disclose security vulnerabilities through coordinated programs, and I build web and mobile apps with security designed in from the first line.

Work

  • Security research

    Ongoing vulnerability research inside published bug bounty and coordinated disclosure programs, tested only against the assets each program puts in scope, using test accounts I own.

  • App development

    Web and mobile apps built secure by design: threat modelling before features, least-privilege data access, and an attacker's review before release. The first releases are in progress.

  • Testing by arrangement

    I take on a small number of penetration tests of web apps and APIs, mainly where an organisation needs a careful manual review of authorisation and business logic. Each one starts with the three steps above.

Principles

  1. Authorised only. No testing without a program policy or a signed authorisation that covers it.
  2. Stay in scope. If the scope is unclear, I ask before I test.
  3. Own accounts, not other people's. I prove issues between accounts I control and never access real users' data.
  4. Private first. Findings go to the owner privately and are never published without their agreement.
  5. Minimal data, then deleted. Evidence is kept encrypted and only as long as the engagement or disclosure needs it.

Disclosure

Found a security issue in something of mine? Email [email protected]. Contact details are also published in security.txt. I'll acknowledge reports promptly and keep you updated until the issue is fixed.

Contact

[email protected]

For research coordination, program enquiries or a testing engagement.

Business
David Duong, sole trader, trading as DDSec
ABN
56 239 087 517
Based in
Sydney, New South Wales