Muhammad Daffa
Vulnerability Researcher at spiderSilk
Surabaya, East Java, Indonesia
Summary
🤩
Rockstar🎓
Top SchoolMuhammad Daffa is a vulnerability researcher and experienced bug hunter based in Surabaya with seven years of hands-on security work across private, public, and freelance engagements. He investigates 0-day and N-day vulnerabilities at spiderSilk while maintaining an active HackerOne presence (Reputation: 637) and a track record of meaningful reports to companies like Automattic, Valve, and MariaDB. His background includes penetration testing for educational and government organizations, infrastructure work for a large city admissions system, and teaching cybersecurity courses—demonstrating both practical and instructional strengths. Comfortable bridging offensive research and operational security, he produces thorough pentest reports and early-warning disclosures that help teams remediate risks before exploitation. Notably, he pairs deep technical testing with deployment and monitoring experience (Nginx, MySQL, Grafana/Prometheus), giving him a broader systems perspective than many vulnerability specialists.
7 years of coding experience
1 year of employment as a software developer
Informatics Engineering, Informatics, 3.73, Informatics Engineering, Informatics, 3.73 at Institut Teknologi Sepuluh Nopember (ITS)
Indonesian, English
Github Skills (109)
penetration-testing10
apikey10
web-application10
ibm-cloud10
privilege-escalation10
vulnerability-scanners10
web-application-security10
enumeration10
gcp10
security10
haiku10
dns10
vulnerability-detection10
bypass10
scanner10
Programming languages (13)
Github contributions (5)
daffainfo/AllAboutBugBounty
Sep 2020 - Dec 2022
All about bug bounty (bypasses, payloads, and etc)
Contributions:1 review, 52 commits, 3 PRs in 2 years 3 months
security-toolsbugbountypayloadreconnaissancepentest
daffainfo/all-about-apikey
Aug 2021 - Jul 2022
Detailed information about API key / OAuth token (Description, Request, Response, Regex, Example)
Contributions:10 commits, 1 PR, 69 pushes in 11 months
oauthregexapiapikeybugbounty
Find and Hire Top DevelopersWe’ve analyzed the programming source code of over 60 million software developers on GitHub and scored them by 50,000 skills. Sign-up on Prog,AI to search for software developers.