Design a repeatable pipeline for mapping an authorized web application, identifying its API surface, and validating findings safely.
What I built
CDP-based application mapping and session-aware discovery
REST and GraphQL API discovery, including parameters and nested JSON fields
Page, request, and resource relationship mapping
Multi-actor permission matrix for access-control checks
Automated proof-of-concept generation within an authorized testing workflow
Technical approach
The workflow separates discovery, reproduction, and verification. Safe validation and deterministic checks help make findings reproducible while keeping the scope focused on authorized assessment.
Outcome
A structured security-testing pipeline that turns a web application's visible surface into traceable relationships and repeatable validation steps.