Adrian Zimbran
Independent Security Researcher
Since 2023 I have worked as an independent white-hat security researcher, performing authorized black-box security testing for companies. I test their applications from the outside, report what I find privately, and help their teams fix it.
My research builds on more than seven years as a backend engineer in banking and enterprise identity — including authentication modernization on a Cloud IAM program and access-rights management for a bank. I know how these systems are built, which is a large part of how I find where they break.
Focus areas
Authentication & identity
OAuth 2.0 and OpenID Connect flows, SSO, session and token handling, and access-control logic — the area I also build professionally on enterprise IAM platforms.
Black-box application testing
Testing from the outside with no source code or internal access, the way a real attacker would approach the target, within an agreed scope.
Authorization & business logic
Privilege boundaries, object-level access control, and workflow abuse that automated scanners typically miss.
How I work
- 01
Scope and written authorization
Every engagement starts with an agreed scope and explicit permission from the company. No testing happens outside it.
- 02
Black-box testing
Reconnaissance and manual testing of the in-scope assets, supported by tooling where it helps.
- 03
Reporting
Findings are reported privately with impact, reproduction steps, and remediation guidance.
- 04
Confidentiality
Engagement details and findings stay between me and the client. Nothing is disclosed publicly without their consent.
Security background
Nov 2025 – Present
Cloud IAM Program — Thales Group (contractor)
Modernizing authentication systems on Google Cloud with Java, Spring Boot, Keycloak, and OIDC.
2023 – Present
Independent security researcher
Authorized white-hat black-box security testing for companies.
Oct 2024 – Oct 2025
Romanian Investment & Development Bank
Banking systems engineering, including custom LDAP-based access-rights management and SWIFT integration.
Student research
3rd Prize — International Symposium, Agora University, Oradea
BadUSB security research.
Full engineering history on the About page.
Security testing enquiries
Want an independent black-box assessment of your application? Get in touch to agree scope and authorization.
Contact me