> Have you worked as a consultant at one of the larger firms, like Optiv, Bishop Fox or NCC Group? No I haven't. > What professional experience do you have?

> Have you worked as a consultant at one of the larger firms, like Optiv, Bishop Fox or NCC Group? No I haven't. > What professional experience do you have? Over 14 years of web programming experience. Plus a few years of open source security research. > Have you found serious vulnerabilities and published them? I've found and disclosed security vulnerabilities in basically every popular PHP project (at the very least, every popular framework and CMS). On top of that, several Android and Java app vulnerabilities. Some of them were sev:lo (timing side-channels in application-layer crypto), but a few were sev:hi (trivial remote code execution). > Any bug bounties? Yes, but I've stopped doing them. They aren't worth the time investment.