I review web applications for security issues, hunting vulnerabilities the way a bug bounty hunter would — looking for access-control mistakes and edge cases that turn into lost funds. My reviews are written from an attacker's point of view.