Awards

Top-Rated Instructor — Hackers do Bem, Wave 1 Issued by RNP (Rede Nacional de Ensino e Pesquisa), December 2024.

Hackers do Bem is a Brazilian national cybersecurity training initiative that identifies and develops new talent across the country, offering free education in ethical hacking and offensive and defensive security. At the end of each training cycle, students vote to recognise outstanding instructors on teaching quality, engagement, technical knowledge, and the ability to inspire and support learners.

Letter of Recognition — Funpresp-Jud Issued by Funpresp-Jud, February 2026.

Formal letter from the Fundação de Previdência Complementar do Servidor Público Federal do Poder Judiciário (the complementary pension foundation for Brazil’s federal judiciary civil servants), signed by its Director, recognising my contribution as an independent security researcher for the responsible disclosure of several vulnerabilities identified in the foundation’s systems.

The research was carried out together with the CVE Hunters team: Marcelo Queiroz, Itauan Santos, Camila S. Andrade, Leandro Cavalcante, Michel Lazzarin and Jairo W.

Letters of Appreciation — NASA (×2) Issued by the NASA Office of the Chief Information Officer, February 2026.

Two letters from NASA’s Vulnerability Disclosure Policy (VDP) program, signed by the Acting Senior Agency Information Security Officer, recognising the identification and responsible reporting of vulnerabilities in NASA systems. Both reports were submitted through the agency’s VDP on Bugcrowd.

One of the two letters was issued jointly with fellow researcher Tr0p.

Hall of Fame

Acknowledged by the vulnerability disclosure programs of 6 United States federal agencies via Bugcrowd:

• U.S. Department of Commerce
• U.S. Fish and Wildlife Service
• U.S. Environmental Protection Agency (EPA)
• National Credit Union Administration (NCUA)
• U.S. Department of Veterans Affairs
• National Aeronautics and Space Administration (NASA) — ×2 acknowledgements

See the full Bugcrowd profile →

CVEs

Vulnerabilities discovered, reported and published through CVE Hunters and the Thoropass Vulnerability Research Program, always under coordinated disclosure.

40 published CVEs

Talks

2026

• Quality over Quantity: How to publish CVEs that actually matter — DEF CON 34, Red Team Village. August 2026. 🇺🇸 English Materials
• The CVE-Hunters Project: From Noobs to Researchers — DEF CON 34, La Villa Hacker. August 2026. 🇪🇸 Spanish
• Análise de vulnerabilidades, riscos, ameaças e repercussões e monitoramento do ciberespaço — Escola Superior de Guerra (ESG), CSSDC. 2026. Guest lecturer. 🇧🇷 Portuguese

2025

• From Curiosity to Impact: The CVE-Hunters Project — DEF CON 33, DC NextGen Village. August 2025. 🇺🇸 English
• From Noobz to Vulnerability Researchers: The Journey of the CVE-Hunters — DEF CON 33, Noob Village. August 2025. 🇺🇸 English
• From Noobz to Vulnerability Researchers — Ekoparty 2025, OWASP Village, Buenos Aires. October 2025. 🇪🇸 Spanish
• From Noobz to Vulnerability Researchers — Hacking na Web Day, Rio de Janeiro. September 2025. 🇧🇷 Portuguese
• Hacker Ético: Caminhos para uma Carreira em Ciber Segurança — CEFET, SEPEX. 2025. 🇧🇷 Portuguese
• RedTeam Operations e OSINT — Escola Superior de Guerra (ESG), CSSDC. 2025. Guest lecturer. 🇧🇷 Portuguese
• Análise de vulnerabilidades, riscos, ameaças e repercussões e monitoramento do ciberespaço — Escola Superior de Guerra (ESG), CSSDC. 2025. Guest lecturer. 🇧🇷 Portuguese

2024

• Desafio OSINT — Globo Sec Week. 2024. 🇧🇷 Portuguese Challenge on TryHackMe
• OSINT na Prática — Escola Superior de Guerra (ESG), CSSDC class of 2024. 2024. Invited student speaker. 🇧🇷 Portuguese
• Políticas de criação de senha — Globo Seg Vibes. April 2024. 🇧🇷 Portuguese

2023

• OSINT — Globo Sec Week. August 2023. 🇧🇷 Portuguese
• Black Hat e DEF CON — Globo Tech Cast. August 2023. Podcast. 🇧🇷 Portuguese

2022

• Análise de vulnerabilidades e Riscos — MULTIPLICADORES, Globo. June 2022. 🇧🇷 Portuguese

Slide decks on GitHub →

Publications

• Framework de autoavaliação para maturidade em defesa contra Ransomware — Escola Superior de Guerra (ESG), CSSDC. 2024. 🇧🇷 Portuguese. Academic essay advised by Diego Cardoso Borda Castro, proposing a self-assessment framework that maps the main ransomware attack vectors so organisations can measure and strengthen their defensive posture. PDF
• The XSS Threat Isn’t Going Away — HackerNoon, August 2025. On why Cross-Site Scripting is still a live risk despite modern frameworks and WAFs.
• CVE-2025-0133: The XSS Threat Isn’t Going Away — final project for CSCI E-159 — Introduction to Cybersecurity, Harvard Extension School, Spring 2026. A study of a reflected XSS vulnerability in Palo Alto Networks GlobalProtect, and why a “medium” severity bug on an authentication portal is anything but cosmetic.

Press

• CVE-Hunters, The Journey of Aspiring Vulnerability Researchers — cvehunters.com, August 2025. Coverage of the DEF CON 33 presentation and of how the CVE-Hunters project turns students into published vulnerability researchers. Written by Elisangela Mendonça, with Karina Gante contributing.
• Discovery of 51 CVEs — How Caido Helped Our Open Source Security Research — cvehunters.com, June 2025. How the group used Caido to find and disclose 51 CVEs across the WeGIA and i-Educar platforms. Written by the CVE-Hunters contributors.
• Rádio Roquete Pinto 94,1 FM — March 2024. 🇧🇷 Portuguese. Radio interview on the work of Instituto Um Passo de Cada Vez.
• Bom Dia Favela — TV Band Rio, February 2024. 🇧🇷 Portuguese. Television interview on the work of Instituto Um Passo de Cada Vez.
• Live Black Novembro 2023 — Desec Security, November 2023. 🇧🇷 Portuguese. Guest interview on building a career in cybersecurity.

Community

• Vice President — Instituto Um Passo de Cada Vez, leading the organisation’s technology side, from Microsoft licensing to day-to-day infrastructure. Previously a volunteer instructor there, teaching computing and English to children from low-income communities.
• Founder — CVE Hunters, a group that mentors newcomers through finding, reporting and publishing their first CVE, with a focus on open-source projects of social impact.