Cybersecurity student focused on web exploitation, access-control flaws, agent offense and defense, and responsible disclosure. This preview intentionally redacts target details, payloads, endpoints, and personal identifiers.
Security work grounded in real systems, careful validation, and responsible public reporting.
I am a security-focused computing student with hands-on work across university systems, especially identity flows, student-service platforms, and legacy web applications.
The public version should emphasize classes of findings and reporting discipline rather than raw exploit detail. That makes the page stronger and safer at the same time.
Current direction: web pentesting, agent offense and defense, vulnerability research, traditional visual algorithms such as KCF, introductory open-source research, and turning private reports into clean public case studies.
My work spans hands-on vulnerability research and research on the reliability and security of LLM agents operating through real environments.
I collaborate with Dr. Liyi Zhou and his PhD student, Ziyue Wang, on the security and reliability of LLM agents. Our 2026 work includes EnvTrustBench and EvoHunt.
Agentic AI Security.
A playbook evolution environment that lets security-auditing agents learn, revise, and transfer vulnerability-hunting procedures across models and harnesses.
An extensible agentic framework for evaluating whether LLM agents overtrust stale, incorrect, or malicious evidence from their operating environments.
Public and private vulnerability reporting.
Six public EvoHunt team outcomes and three masked placeholders for assigned records awaiting publication. Public reports shown here were submitted by me; these are team outcomes rather than independent discoveries.
Certificate OID verification constraints silently dropped.
Insufficient verification of transparency-log timestamp authenticity.
DSSE payloadType type-binding failure.
Host-header-driven backend routing bypass.
Cross-origin updater redirects can expose credential-bearing headers.
Malformed Host or Origin headers can terminate the development server.
Nine responsibly reported findings across SSO, library, leave-management, OA, and other campus web systems.
Reported weaknesses in account and verification flows, including abusive verification paths and exposure in account-related records.
Reported access-control issues affecting leave-management and booking systems, where personal or workflow data could be returned across users.
Documented XSS-class issues, guest-access mistakes, and file-exposure problems in older campus platforms.
An institutional certificate recognizes vulnerability reporting and remediation support. Technical details, identifiers, and reproduction steps remain private.
Master of Computer Science.
Electronic Information Engineering student.
7th place at the University of Sydney.
4th place at Macquarie University.
Head of the Network Security Department at Dalian Maritime University.