Security Engineer @ Profullstack Inc & Independent Security Researcher

Eduardo
Camarillo

Cryptography, web application security, and applied threat modeling.

Security specialist focused on cryptographic protocol auditing, web application pentesting, zero-trust architecture, and adversarial threat modeling.

Research & Audits
2026-08

QryptChat — Pentest & Security Assessment

Full-stack security assessment of the QryptChat encrypted messaging platform. Covered the web application, API layer, cryptographic implementation, authentication flows, and Supabase RLS policies. Identified critical vulnerabilities in access control and data exposure that compromised the E2EE model.

37 findings — 3 critical, 12 high, 22 medium/low
Critical: global user table leak (86 users, phone numbers exposed), conversation injection, unread message exfiltration
Business impact: PII breach confirmed in production, E2EE model compromised, account takeover vector
Web Pentest E2EE
2026-08

ThreatCrush — Security Architecture

Security architecture and design for ThreatCrush, a Continuous Threat Exposure Management platform that unifies SIEM, EDR, and SOC capabilities into a single agent. Led internal security assessments and cryptographic design review for the real-time threat intelligence pipeline. Platform deployed across web, CLI, desktop, mobile, and browser extension.

40 findings — 2 critical, 9 high, 12 medium, 15 low
Critical: cryptographic design flaws and API security gaps in real-time threat pipeline
Business impact: secure-by-design foundation for CTEM platform before production launch
CTEM Architecture
2026-07

CoinPayPortal — Security Audit

Comprehensive security audit of a non-custodial multi-chain crypto wallet. Assessed key management (BIP39/BIP32/BIP44), HD key derivation, transaction signing, authentication, XSS/CSRF protections, CSP configuration, and rate limiting across Bitcoin, Ethereum, Polygon, Solana, and Bitcoin Cash chains.

87 findings — 3 critical, 39 high, 45 medium/low
Critical: CSP missing, no HTTPS enforcement, XSS exposure via localStorage
Business impact: wallet security posture validated; critical hardening gaps identified and remediated
Web3 Crypto Wallet