Sukhbat Zundui · deprrous / Hackratic / C47 / R47
Web and application security research with public work across open-source ecosystems, bug bounty programs, and competitive CTFs.
Evidence standard / no self-rating Public claims link to advisories, merged patches, verified profiles, or official scoreboards. Private experience is labeled clearly and never presented as public proof.
DevOps Engineer · Systems Engineer · White-box Security Testing
Engineering and securing production telecommunications systems in Mongolia. Responsibilities combine infrastructure operations with source-assisted security assessments and remediation work across internal product teams.
Internal findings remain confidential; only role scope and public products are listed.
01 / Public record
Published findings credited to deprrous. Each entry links to a public advisory or disclosure rather than a private claim.
An authorization flaw in autoTranslate.translateMessage exposed
message content outside the caller’s room membership. Reported through
HackerOne and resolved by Rocket.Chat.
A malformed authorization header could make getToken() throw an
uncaught exception, turning invalid input into per-request availability loss.
Numeric and standard XML entities bypassed expansion limits, allowing crafted input to consume disproportionate CPU and memory despite an earlier fix.
File-search middleware and loaders did not consistently confine resolved paths to their intended roots, enabling traversal through patterns and symlinks.
Separate DNS resolution during URL validation and image fetching created a TOCTOU window that could redirect a permitted hostname to an internal address.
Two independent unsafe innerHTML paths in SVG and select schemas
allowed attacker-controlled template values to execute script in consuming UIs.
Bug bounty / verified record
Four findings appear across the public HackerOne profiles. One additional valid Immunefi report remains private and is labeled separately.
HackerOne publicly verifies the Supabase and Vercel resolutions. Supabase Medium 4.3, Vercel Medium 6.3 / Tier 1, and the Immunefi Low result include researcher-confirmed private metadata; technical disclosure content is intentionally omitted.
02 / Competitive security
CTF competitor with Hackratic, appearing on the C47 roster in Web / Crypto. Also competes under the related C47 and R47 names.
AITU reports 839 qualifier entrants; CTFtime lists 270 ranked teams. C47 placed #3 overall and #1 internationally, then finished #10 of 20 at the Astana final. C47 also won the official GeoGuessr tournament.
Hackratic qualified in 9th place and plans to attend the in-person final in September.
Official qualifier ↗Hackratic finished 24th of 185, inside the 25-team cutoff, but could not attend the Paris final because travel funding was unavailable.
Qualification record ↗Advanced beyond qualification rounds in multiple domestic competitions. This records progression only; no podium placement is claimed.
Team metrics are Hackratic results, not individual rankings. Sources: Hackratic, CTFtime, and AITU.
03 / Built in public
Maintainer-accepted fixes and public tools, linked directly to the upstream record.
WW-5585 → WW-5659
PR #1815 identified a real concurrency defect and supplied the reproducer. The maintainers carried that scenario and test into merged successor PR #1816, with deprrous recorded as co-author.
Thread-safety fix, not presented as a framework vulnerability.PR #11500
Reported the crash path that led to the merged fix and a maintainer-added public bug-contributor credit.
PR #1709
Fixed the missing pragma-pop helper for uninitialized const-pointer diagnostics, validated against the Clang preprocessor output.
04 / Operating profile
I’m Sukhbat Zundui, known as deprrous, a Mongolia-based security researcher focused on finding the gap between what software assumes and what an attacker can control.
My public work spans authorization, path boundaries, parser limits, SSRF, and client-side injection. I hunt across open-source projects and coordinated disclosure programs, including HackerOne and Immunefi.
Outside research, I compete with Hackratic and its C47 / R47 rosters, primarily across web and cryptography challenges.
This portfolio is a factual record, not a self-assigned ranking. Public work links to its source; private responsibilities are identified without exposing internal details.
I also prepare upstream fixes for Google’s OSS Patch Rewards program. No Google reward is claimed here unless it appears in the public rewarded-patches record.
05 / Contact
Open to research collaboration, security engineering, and CTF conversations.