I research web application security, build software, and document what I learn.

Security Research · Marcalyx

I'm a Nigerian full-stack engineer and security researcher interested in understanding how modern web applications work — and how they can break.

My security research focuses primarily on:

• Web application security
• API security
• Authentication & authorization
• Broken access control
• Business logic vulnerabilities
• XSS
• CSRF
• SSRF
• IDOR
• GraphQL security
• OAuth and identity flows
• File upload vulnerabilities
• Information disclosure

I also build web applications and products, which gives me a perspective from both sides of the security problem.

I participate in bug bounty programs and security research, focusing on finding vulnerabilities in real-world applications and responsibly disclosing them to affected organizations.

📖 mario.marcalyx.com

My public research archive contains:

• Vulnerability write-ups
• Responsible disclosures
• Technical breakdowns
• CTF and security lab research
• Things I've learned while researching

I'm a full-stack developer with experience across modern web technologies.

• React
• Next.js
• TypeScript
• Tailwind CSS
• React Native

• Node.js
• Express.js
• NestJS
• Django
• Django REST Framework
• Flask

• PostgreSQL
• MongoDB
• MySQL
• MariaDB
• SQLite
• Redis
• Supabase
• Firebase

• Git
• REST APIs
• GraphQL
• Puppeteer
• Figma
• Blender

I enjoy turning ideas into working products.

Some of the things I've worked on include web applications, SaaS products, developer tools, automation systems, and other software projects.

More of my work can be found throughout my GitHub repositories.

I'm continuously improving my understanding of:

• Web application security
• Advanced API security
• Authentication systems
• Vulnerability research
• Exploit development
• Secure software architecture
• Django REST Framework

I like understanding systems from the inside out.

When researching a target, I try to understand:

Application
    ↓
Architecture
    ↓
Trust boundaries
    ↓
Authentication
    ↓
Authorization
    ↓
Data flow
    ↓
Business logic
    ↓
Attack surface

The goal isn't simply to find something that looks strange.

The goal is to understand why it happens, what an attacker can actually do with it, and how it should be fixed.

Break it. Understand it. Report it. Learn from it.

Security research is a continuous learning process.

Every vulnerability — including the ones that turn out to be duplicates or false positives — teaches something about how systems are designed and where assumptions can fail.

• 🌍 Security Research: https://mario.marcalyx.com/
• 🏢 Marcalyx: https://marcalyx.com/
• 🐦 Twitter/X: https://twitter.com/imemariojerry
• 💼 LinkedIn: https://linkedin.com/in/ime-mario-jeremiah
• 📧 Email: mario@marcalyx.com

I really love music, instruments, and Spotify. 🎵

Building software. Breaking assumptions. Learning continuously.