Kaan Dedeoğlu — Security Researcher

01 Education

BSc in Computer Engineering

Sep 2020 — Jun 2025

Eskişehir Technical University, Turkey — Language of Instruction: English

Prof. Dr. Fuat Sezgin Fen Lisesi

Sep 2016 — Jun 2020

Science High School — Silivri, Istanbul, Turkey

02 Experience

Independent Security Researcher

Jul 2025 — Present

HackerOne — @dedephus — Remote

Highest severity validated to date: Critical, CVSS 9.6
Submitted 58 reports across 12 bug bounty programs since April 2026. Every report ships with a reproducible PoC and a severity argued in CVSS terms; the first bounty was awarded in August 2026.
How I work: read the open-source codebase for authorization gaps and unguarded internal clients, then prove each candidate with a working end-to-end PoC on a local deployment. I do not report anything I cannot prove.
Built and maintain the-grind, the research platform this work runs on — reconnaissance, exploitation, adversarial validation and report drafting in one continuous loop rather than a scanner. Detail under Projects.
Program names and technical detail stay out of public writing until the vendor discloses the report. None of the findings to date are disclosed, so none of them are described here.
Ramped up full time from July 2025 — web application security fundamentals, systematic study of disclosed HackerOne reports and public vulnerability research, and a repeatable testing methodology — before the first submission in April 2026.

IT Systems Intern

Oct — Dec 2024

Eskişehir Technical University — IT Department, Systems & Networking

Deployed a production-like DSpace 8 backend for the university’s digital library, with two other interns: Java 17, Maven, Ant, PostgreSQL and Apache Solr on an Ubuntu 22.04 VM provisioned by the IT staff.
Hardened the database layer: a dedicated PostgreSQL role, connection security through pg_hba.conf, and the pgcrypto extension for UUID support.
Configured Solr cores for DSpace search, integrated MaxMind GeoIP for usage statistics, and ran the application as a Spring Boot service with its own properties and logging.
Configured HTTPS through an Apache reverse proxy with a Let’s Encrypt certificate, and automated daily indexing, media filtering and checksum verification with cron.

IT Systems Intern

Jul — Aug 2024

Creentech — Istanbul, Turkey — Systems & Network Department

Administered Debian-based Linux systems: user and permission management, sudo policy, APT package management, systemd services, and cron automation scripted in Bash.
Assisted the network team with FortiGate firewall policies, VLAN setup, static routing, web filtering and AP/switch integration.
Worked alongside production monitoring in Grafana and Zabbix, virtualization on VMware and Nutanix, and Active Directory administration.

03 Training & Development

Garanti BBVA Technology Security Academy

Oct 2023 — Feb 2024

Enterprise Technology & Cybersecurity Training Program — Patika.dev

Top 20 of 3,600 applicants — 450 admitted, narrowed to 20
Covered Linux internals, network protocols and enterprise application security, with threat modeling and secure architecture review applied to real-world systems.

04 Certifications

Wiz

Bug Bounty Masterclass

Apr 2026

OWASP Top 10 Web App Security Bug Bounty

Udemy

Sıfırdan Bug Bounty ve Web Uygulama Güvenliği

Jul 2025

Web App Security OWASP Top 10

Cisco

NDG Linux Unhatched

Feb 2025

Linux

Cisco

Introduction to Cybersecurity

Jan 2025

Cybersecurity

TryHackMe

Pre Security

Mar 2024

Network Fundamentals Linux Fundamentals

TryHackMe

Introduction to Cyber Security

Feb 2024

Cybersecurity

Garanti BBVA Teknoloji

Patika.dev & Garanti BBVA Güvenlik Akademisi

Dec 2023

App Security Linux Networking

05 Projects

the-grind — Autonomous Security Research Platform

Apr 2026 — Present

Python, TypeScript, Bash, Caido, Docker — private repository, walkthrough on request

Designed the platform to run the whole bug bounty workflow as one continuous agent loop rather than a scanner: reconnaissance, attack-surface mapping, exploitation, PoC generation, adversarial validation and report drafting. About 1,400 commits over four months.
Encoded 19 vulnerability classes as 27 executable methodology modules (~10,800 lines): broken access control and IDOR, SSRF, SQL and NoSQL injection, XSS, authentication bypass, OAuth/SAML, race conditions, RCE, SSTI, XXE, path traversal, cache poisoning, GraphQL, WebSocket, cloud and CI/CD misconfiguration, and LLM/AI application security.
Wrote ct, a context-frugal interface to the Caido proxy. The stock client pushed full request and response bodies into the agent’s context window and exhausted it within a few requests; ct replaces that with filtered traffic reads, regex search inside stored responses, batch variant testing that surfaces only deviating responses, one-shot authorization verdicts, and field-level A/B diffing.
Built brutal-triager, a three-pass adversarial validator that has to fail to refute a finding before it can be reported: hostile code review with one decisive empirical test, a fresh PoC reproduction pass that hunts fabricated evidence, and severity benchmarking against 14,617 disclosed HackerOne reports plus live CVE research.
Enforced a deliberately selective promotion gate: a lead becomes a reportable finding only with an unconditional end-to-end PoC, a concrete victim and concrete damage, and a final exploitation step an external researcher can actually execute. That gate is what keeps speculative work out of submissions.
Integrated the supporting toolchain: every request through one auditable proxy, interactsh for blind and out-of-band confirmation, Playwright for browser-verified client-side findings, a custom SSRF scanner, and JavaScript bundle secret mining. Each session appends its dead ends to a persistent learnings file that the next one reloads.

OSTEODEEP — AI-Driven Bone Health Assessment with Chatbot Integration using X-rays

Jan 2024 — Jun 2025

Graduation Thesis — Eskişehir Technical University

IEEE Published TÜBİTAK 2209-A Funded

Built the ML pipeline over 1,947 knee X-rays collected from public repositories: CLAHE contrast enhancement, augmentation constrained to preserve anatomical integrity, and class balancing for the underrepresented osteopenia class.
Extracted deep features in parallel from EfficientNetB2 and VGG-19, fused the feature vectors and reduced them with PCA (300 components), then trained a stacking ensemble — SVM (RBF) and XGBoost base learners under a logistic-regression meta-learner, tuned with GridSearchCV inside 5-fold cross-validation.
Reached 90.10% accuracy, 90.14% weighted F1 and 0.96 macro ROC AUC on 3-class classification, with 91.20% recall on the clinically hardest osteopenia class — ahead of standalone CNN baselines.
Integrated a ChatGPT-based assistant through the OpenAI API that turns each diagnostic outcome into specific guidance on osteoporosis risk, prevention and lifestyle.

IEEE Xplore Open-access PDF GitHub

06 Technical Skills

Security

Web App Security OWASP Top 10 IDOR / BOLA / BFLA SSRF SQL & NoSQL Injection Auth & OAuth/SAML Race Conditions Source-Code Review CVSS

Tools

Caido Burp Suite ffuf nuclei interactsh Playwright

Systems

Linux Administration Networking Docker Git PostgreSQL Reverse Proxies CI/CD

Programming

Python TypeScript Java (Spring Boot) Bash SQL