PentraSec

I’ve been doing independent security research and outreach-based testing, focusing on real-world web applications rather than lab environments. One thing that stands out quickly is how many production systems still ship with avoidable security flaws.

During one of my recent outreach-based tests on a live application, I identified a vulnerability that could have exposed sensitive functionality if exploited. What made it more interesting wasn’t just the bug itself, but how it surfaced: no automated scanner flagged it, and it had likely gone unnoticed due to a lack of continuous security testing.

This experience reinforced a pattern I keep seeing—security is often treated as a one-time checklist rather than an ongoing process. Smaller teams especially tend to rely on post-launch fixes or occasional audits, which leaves gaps attackers can realistically exploit.

It also highlighted the value of direct, manual testing combined with outreach. Some of the most meaningful findings don’t come from tools alone, but from understanding how real systems behave under real conditions.

I’m now building PentraSec around this idea: making proactive vulnerability detection more accessible, continuous, aligned with how actual attackers think and operate, and hitting a revenue of $1000 on my second month of launching.

Still early, but the goal is simple—help teams catch critical security issues before they become real incidents.