I break apps and APIs
because I understand
how businesses operate.

Marius du Preez

Marius du Preez. Full-time security researcher focused on web applications, APIs, and the systems behind them, with mobile clients as an additional attack surface. 8 years in cloud infrastructure and tech, followed by 9+ years running my own businesses. That combination means I find the vulnerabilities your pentest missed.

Web & APIs Business Logic Access Control Cloud Android Reverse Engineering
203
Reports Submitted
70
Critical Severity
64
High Severity
4
Platforms

Last updated: July 2026

Why I Find What Others Miss

📱

Application and API Hunting

I test web applications and APIs for broken access control, exposed data, authentication flaws, and business logic issues. When a mobile client is part of the attack surface, I reverse engineer it and follow the trail into the APIs and backends behind it.

☁️

Infrastructure Experience

8 years in cloud migrations, VM migrations, and managing production infrastructure. I understand how backends are put together, from IAM policies to API gateways, and where the assumptions break down.

📈

Business Logic Focus

9+ years running my own businesses, managing $10k/day ad spend, and understanding how products and payment flows actually work. I find logic flaws like race conditions, privilege escalations, and payment bypasses. Not just technical bugs.

Published Reports

Critical

Photo Upload Reads Files Off the Production Servers

A crafted image uploaded to the photo feature made the server read arbitrary internal files, with the contents served straight back on a public image host.

Web / File Upload / Local File Read Critical

Deep Link Loads Attacker Page in Bridge WebView - Full Account Takeover

A single tap on a crafted deep link loaded an attacker page inside the app's privileged bridge, stealing the live session token and unlocking the full trading API.

Android / Deep Links / JS Bridge Critical

Server Tricked Into Leaking Live Cloud Credentials

An upload endpoint fetched any attacker-supplied URL server-side and stored the response, pulling live cloud credentials straight from production infrastructure.

Web / SSRF / Cloud
View all 129 reports →

Platforms

Bugcrowd
HackenProof

Background

2026 - Present

Full-Time Security Researcher

Vulnerability research across public and private programs covering web applications, APIs, mobile clients, cloud services, and business logic. 203 reports, including 70 critical findings.

2025

ContentAutomate - Founder

AI-powered SEO content platform. Clients averaged 340% traffic growth in 90 days, with 85% of articles ranking top 10 within 6 months.

2022 - Present

ApeSpace - Co-Founder

DeFi trading tools with the fastest and most accurate charting data. Grew to 3,000+ daily organic visitors.

2017 - 2021

Swell Marketing - Founder

Mortgage broker lead generation. Managed $10k/day in ad spend with profitable unit economics across Google and Meta.

2010 - 2018

QCS Group - Cloud Infrastructure

8 years in cloud migrations, VM migrations, and managed service consulting. The foundation that makes understanding backend vulnerabilities second nature.

Need a security researcher?

Available for web application, API, and mobile security assessments and consulting.

Get in touch [email protected]