Checklist · PDF · 11 pages · A4
A no-fluff checklist for testing APIs, in the order of a real engagement.
Free
LLM securityandAPI security
- OWASP LLM Top 10
- OWASP API Top 10
- Prompt injection
- Jailbreaks
- RAG pipelines
- AI agents
- Access control
- GraphQL
- REST APIs
- Burp Suite
Most AI features ship without anyone trying to break them. I test LLM apps and APIs the way an attacker would, and hand your team a report it can fix from the same day.
Case studies
Key Challenges I Solve.
Manipulable AI Features
Prompt injection, jailbreaks and leaky system prompts turn your chatbot or agent into a tool for whoever talks to it.
Look how I solve thisUndetected Vulnerabilities
Automated scanners miss broken access control and business-logic flaws, the bugs that actually get your users' data out.
Look how I solve thisUntested Releases
Every release can reopen what the last test closed. A free retest and an optional retainer keep security moving with you.
Look how I solve thisServices
Take a Look at What I Offer.
Find out how your chatbot or AI feature can be manipulated before a user does.
LLM Application Security Assessment
Startups and SMEs shipping a chatbot or AI feature.
- Direct and indirect prompt injection
- Jailbreaks
- System prompt and sensitive data leakage
- Unsafe handling of model output (XSS, injection)
- Data poisoning in RAG systems
- Resource and cost abuse (token abuse)
From€300· 1-3 weeks
Learn moreWork
Proof of Work.
Lab and CTF write-ups, disclosed findings and client engagements.
Finding
A presigned S3 policy that restricted nothing
Stored XSS hosted on the platform's own CDN, through four features sharing one flawed upload policy.
- Private VDP · target redacted
- Reported · unpatched
About
Who I Am.
I'm a security researcher specialising in AI systems. Their complexity fascinates me, and I like things that are hard.
I started out as a full-stack web developer and built a few SaaS products, but I realised it wasn't the field that pushed me the most. So I went from building systems to breaking them.
I'm active in research, and I share what I learn on LinkedIn, YouTube and X.
If you're building on AI and want someone to break it before someone else does, get in touch.
Resources
Testing on Your Own?
Checklists, guides and playbooks from my own methodology.
Contact