About

VardrSec

VardrSec develops open-source tools for scoped security testing and publishes research from SSH and API decoy sensors. The goal is practical, reproducible work with clear evidence and limitations.

Founder / Maintainer

Jorge Aquino

I served as a Marine and then as a Firefighter/EMT before turning to application security.

I'm a member of the OWASP Foundation. My main research focus is broken access control, including authorization at the object, property, and function level.

What I work on

Authorization bugs are easy to miss. The request succeeds and the response looks normal; the defect is that the wrong user received the data. Scanners have trouble finding them because the access rules usually aren't written down anywhere a tool can read.

I build open-source tools for this:

• VardrGate: tests a policy file against live API responses and can fail a CI build on a regression.
• VardrMap: an engagement tracker that keeps scope, assets, evidence, and findings in one place, so test coverage is recorded rather than remembered.
• VardrRunner: runs scan jobs on your own machine and uploads results to the backend.

I also run SSH and API decoys and publish what they record in the Threat Observatory.

The checklists on this site can be copied into tickets and code-review templates.

Elsewhere

• github.com/VardrSec: the tools
• github.com/jorge-aquino: personal projects
• AbuseIPDB: IP addresses I've reported for abusive traffic