benihacking

visitor@benihacking:~$ ./welcome

Benjamin Kincses, full-stack developer and security researcher

Full-stack developer and security researcher from Hungary. I find bugs, prove them, fix them, and get the fixes merged.

hire me ./projects open the terminal research page
benjamin@benihacking: ~/session
$ whoami
benjamin kincses, full-stack developer & security researcher, hungary

$ cat mission.txt
find real bugs in other people's code. prove every one of them.
fix them properly, with tests. get the fix merged.

$ ./status --now
52 PRs merged in the sprint to 100. 181 open right now.
reports live on bugcrowd, intigriti, yeswehack. no proof, no report.

~/hire-me

Websites and web apps for businesses, built fast, fixed price agreed before work starts.

Business website

from $500

Clean, fast, works on phones, set up for local search.

Online store

from $850

Products, checkout, payments working.

AI chatbot for your existing site

from $1,200

Answers from your own content, GDPR-aware setup.

How it works

  • 50 percent deposit before work starts.
  • You watch the build on a live preview link the whole time.
  • Source files and launch happen when the final payment lands.

Nobody gets work stolen, on either side.

Proof, not promises: 50+ pull requests merged into real open source (pnpm, the GitLab CLI, Home Assistant, Supabase, Payload CMS). 10 vulnerability write-ups published under my name on WPScan. First paid bug bounty accepted on YesWeHack.

start a project

~/status

52PRs merged in the sprint to 100
10CVEs published on WPScan, 2026-11-09
181PRs open right now
21GitHub advisories filed
3bounty platforms, reports in triage
EUR 300first paid bounty, accepted on YesWeHack
budapest --:--:-- session uptime 00:00 last updated 2026-11-10 [ open for freelance work ]

~/about

I spend most of my time on open source and security research. I find real bugs, fix them, and get the fixes merged. 52 merged pull requests in my current sprint toward 100, sitting in mypy, Home Assistant, Payload CMS, Medusa, pnpm, prettier plugin-php, and a long list of smaller projects.

I prefer fixes with tests over drive-by changes, and I stay on a thread until the maintainer is satisfied. On the bounty side every finding gets a working proof of concept before it is reported. No proof, no report.

Self-taught, freelance, based in Hungary. Reports and fix pull requests carry my full name.

~/skills

TypeScript, JavaScript, Python, PHP, Node.js, React, Next.js, Linux, Docker, Git, GitHub, GitLab, Bash

TypeScript and JavaScript, Python, PHP. Node.js, React, Next.js. WordPress and WooCommerce when the job calls for it. Linux, Docker, Git, GitHub Actions. Burp Suite and the usual audit tooling on the security side.

~/projects

Clash Royale AI

An AI player for the real game. Behavior cloned from 19,800 pro replays.

status: parked

Open source, the long tail

Merged fixes in mypy, Home Assistant, Payload CMS, Medusa, pnpm, prettier plugin-php and more. The sprint board says 52 of 100.

github.com/benjaminkincses

Client work

I also build websites for businesses: fast, clean on a phone, set up for local search. Three sample builds, made the way a client job runs:

Samples show the work. Your site gets your name, your text, your photos. Start a project.

~/research

Code audits and bug bounties. Reports in triage on Bugcrowd, Intigriti, and YesWeHack. Every finding gets a working proof of concept before it is reported. The merged fixes, reviews, and disclosures in progress are on the research page. Filed GitHub security advisories:

Octopus-SI-OS

  • GHSA-c558-f85p-7349 High
  • GHSA-2j3j-m84x-gjfh Moderate
  • GHSA-82h9-785j-3rj4 Moderate
  • GHSA-qmhj-fjrr-g529 Low
  • GHSA-32mw-j8wg-r86j Low

Nacos

  • GHSA-q43p-chvx-vpx2 High, config authorization cluster
  • GHSA-hm4f-5v62-vrm2 Moderate, unauthenticated gRPC lock handler
  • GHSA-vffc-gmfm-fwh5 Moderate, unauthenticated admin bootstrap
  • GHSA-mjpp-mhh4-69j9 High, OIDC authorization fails open
  • GHSA-3qwh-8qph-35mg High, rolling upgrade latch disables cluster auth
  • GHSA-qg9f-29q9-5f9x Moderate, cipher configs stored in plaintext

Experiential

  • GHSA-3fwg-p649-gfhr High, batch grant bypass
  • GHSA-5mj6-3wwp-4627 High, budget bundle
  • GHSA-8v36-qh6v-jgq4 High, capture working directory code execution
  • GHSA-h5mm-j8x5-rh37 Moderate, planted .env leaks gateway key
  • GHSA-g97v-p7hf-cxq6 Moderate, unauthenticated Pi agent bridge
  • GHSA-p6vv-xw4p-p5vp Low, gateway usage and metrics without auth

OpenCode

  • GHSA-cvp8-pmjf-grpr High, stored XSS on share pages
  • GHSA-6cwg-8rrp-47rr Moderate, webfetch redirect SSRF

GhidraMCP

  • GHSA-77r9-34rq-86x4 High, combined advisory

Robo

  • GHSA-q6qf-27wx-9gpm High, combined advisory

Plus private security research in progress. If I filed an advisory on your project, reply on the advisory. It is the fastest route to me.

~/snake

The snake from my GitHub profile, playable. Arrow keys or WASD on a keyboard, the pad or a swipe on touch.

score 0 high 0

press start, then steer with the arrow keys.

~/terminal

A real shell, sort of. Type help and hit enter. Everything it knows is on this page.

visitor@benihacking: ~

benihacking shell. type "help" for the command list.

~/contact

Start a project, or send me code to break. Email is fastest: [email protected]