Security researcher &
software engineer.
M.S. Cybersecurity candidate at NYIT (exp. 2027). Bug bounty hunter with 11 accepted reports on HackerOne across 5 programs. Based in Kings Park, NY.
Runtime instrumentation and scripting platform, attaches to a live process and exposes a Lua environment over it with an immediate-mode GUI.
Task and habit management app with a social layer, gamification, cosmetics marketplace, medication tracking, and a recurring mascot, built with React Native, Expo, and Supabase.
Automated Roblox API fuzzer that downloads the full engine reference at runtime and fires hostile inputs (NaN, oversized strings, malformed data types) at every property and function to surface crashes and edge cases.
How automated input fuzzing surfaces crashes and unexpected behavior across both open-source codebases and custom runtime environments.
Outside of security and software work, I spend a lot of time at my 3D printer. I own and maintain my own FDM setup and handle the full pipeline myself, from modeling in Blender to slicing, printing, and post-processing. Builds range from functional replacement parts to fully painted props to last-minute birthday gifts. Check out some of my builds below!
Replacement fin modeled in Blender from caliper measurements, prototyped in PLA, and finished in weather-resistant ASA with a clear coat and vehicle-grade adhesive.
Wearable T-60 Power Armor prop helmet with heavy post-processing: bondo, filler primer, paint, weathering, and a custom sunglass lens visor.
Wearable FNAF Springtrap helmet with hand-dyed felt wrapping and a custom elastic jaw mechanism that retains its position and snaps back to rest.
Replica of Killa's helmet from Escape from Tarkov, built as a birthday gift in under 48 hours with post-Soviet weathering and detail work.
Runtime instrumentation and scripting platform, attaches to a live process, exposes a Lua scripting environment over it, and ships an immediate-mode GUI with a script editor and offset diffing view.
Minecraft Forge mod that intercepts, inspects, and replays outgoing serverbound packets via a Mixin hook into the network layer.
2D physics sandbox with impulse-based ball collisions, rigid blocks, per-frame gravity and drag, and interactive spawning, written in C++ with OpenGL and GLFW.
Task and habit management app with a social layer, gamification, cosmetics marketplace, medication tracking, and a recurring mascot, built with React Native, Expo, and Supabase.
Static portfolio with no frameworks or build step. Navigation is SPA-style via view toggling, and detail pages load inline by fetching and parsing the target HTML so the sidebar never leaves.
Automated Roblox API fuzzer that downloads the full engine reference at runtime and fires hostile inputs (NaN, oversized strings, malformed data types) at every property and function to surface crashes and edge cases.
As much as I would like to document every vulnerability I have reported, many companies request that findings remain private. Any writeup published here was performed and shared with explicit permission from the affected developers.
A malicious Aseprite plugin could overwrite debug.getinfo() to spoof its source path and silently inherit another plugin's persisted file-system permissions.
About
I'm Jayden Ferrara, a security researcher and software engineer based in Kings Park, NY. I got my B.S. in Computer Science with a concentration in network security, and I'm currently working toward my M.S. in Cybersecurity at NYIT. I've been building things and breaking them long before I had the credentials to back it up.
On the security side, I hunt bugs on HackerOne with 11 accepted reports, completed a security research internship at ZeroPath, and published a finding on Aseprite's Lua plugin system that earned a $1,000 bounty. On the engineering side, I build whatever I find interesting: a Windows memory editor with an embedded Lua scripting engine, a packet inspection framework for Minecraft, a cross-platform task management app, and a Roblox API fuzzer.
I also teach coding at theCoderSchool. Explaining hard things simply has a way of sharpening your own understanding, and I've found that it carries over into everything else. I'm currently looking for entry-level roles in cybersecurity or software engineering.
Graduate program focused on network security, penetration testing, and secure software development.
Network security concentration. GPA 3.9, Summa Cum Laude.
Performed deep static code analysis on production-grade distributed systems written in Go, Rust, C/C++, and TypeScript, surfacing high-impact SSRF, DoS, and memory safety vulnerabilities. Developed end-to-end remote PoCs in Linux environments using Docker and Kubernetes to demonstrate real-world exploitability. Authored detailed vulnerability writeups translating technical findings into actionable remediation guidance for engineering and security stakeholders.
Teaching children ages 6–17 programming fundamentals across multiple languages, adapting lessons to each student's skill level and learning pace.
Submitted 11 valid vulnerability reports across 5 programs with confirmed triage and bounty compensation. Findings span web application vulnerabilities including XSS, IDOR, SSRF, and authentication bypass.