John Jean

Security research, advisories, and occasional (ultra) bike rides.

Work with me

Want to hire me? next slot in 2 to 3 months

For reference, my daily rate is between 1200 and 1800 euros depending on the mission.

urgent interventions, evenings and weekends included, are possible at the 2000 euros rate.

What I do

Penetration tests and source code reviews, mostly on web applications and what surrounds them (APIs, authentication, proxies, mail…). Twenty years of this, and a CTO background that helps me write for the people who will have to fix things.

  • Penetration tests of web applications and APIs, black box or with the source in hand.
  • Source code reviews (PHP, Python, Go, C, JavaScript…), the kind of work behind the advisories on this site.
  • Security reviews of an architecture or a design before it ships.
  • Technical leadership support for start-ups (product direction, hiring, security posture), sometimes on a volunteer basis.

How it goes

A short call to scope the mission, a fixed number of days, then a report written like the advisories here: every finding with the code path, a proof, and a fix. I don't disappear once the report is sent: we go through it together with your team, I help prioritise, and I take a second look once the fixes are in.

In the middle of an incident? Write to me first. I can join the response, help figure out what happened, what to contain, and what to fix first.

Get in touch

The simplest way to reach me is by e-mail:

john@wargan.com

PGP

If it's sensitive (a vulnerability report for example), please encrypt your message with my public key.

key id
0xDC3CB82BF0967AF0
fingerprint
4572 9EA1 3CE5 C8B5 D2CF 0BD8 DC3C B82B F096 7AF0
file
key.pub
-----BEGIN PGP PUBLIC KEY BLOCK-----

xsFNBF1um0ABEACndDr58kcdSEELxmQqn9EEDrWAAp0YstQg+gOGJ37/oi0fj8gs
OOh7cI6fE+su/bTTuHAY33GDc2ZbAYikNi8MGpa/gnyD9YyJGtA6Fez2tziDkABr
cOSAe7Qs0UFSrIZtPChdV2G0Qvv6l5y16b4L8fErKBTRuJeNsNELAQ4OWomsF3Ik
cTmsDhx6J+VoRCZhJpRp+biLW9hErJvXXFoZm2Y9Nt1KaU1Qjh2Pg5vSLvAMiWF3
KtoeyBzMZHLA6/Y8lbEmWuyitIQKtYXuu407wdYYmTINKL8FPTlBP91RgVYJbl2/
NMEGJ7Nh+YWff7eo0LV20WtTKCFu1jl2uHj16ikHh+GZmx9zdFZFXjtOHGCILpRW
ssUF4hmpZz6B1IgFlnqATMzcQ29PqrU7uXhSp91MgVbkLRGmUOg/KycIVop4Ih1p
81eIJYDTnjzl9kWQyzthrL8WSo00S0IELFrR731yrD27drjxO/zcWkMJg3muE0Tg
PjaVg/CEJhNu8hqg6LLcgwXE/WdR2p55y6Q/3YFAGdpemwsb7/bK+MAKbV+PN4NK
5HHpKoHXbF/7av+lgPB7O2wzV6Ak3G1rGDWV4Ueg197B2nqzbh+XDrmSB2LSRcVI
QKJAuwyYSTE3CY1e9Jk3wVuAaDfDNOGwNWQrP7mCe0eGyywd9SM/8kgRpQARAQAB
zRtKb2huIEpFQU4gPGpvaG5Ad2FyZ2FuLmNvbT7CwY4EEwEKADgWIQRFcp6hPOXI
tdLPC9jcPLgr8JZ68AUCXW6bQAIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAK
CRDcPLgr8JZ68OxyD/4mEFIEFVw7sfceuFp6Dh2123LxkdVzdDErSfqp4GXSa2tO
v93XEXBaFpBvTwm9o21IbWwWGbGba0/Qi4ujYirlqb2P0oZ2uvIg0hicSHkuA6a5
DhZlkkbKSd5r61x05ahJ6unjWysze2OiE4fpX8f46Jm/tBfLo2Qnp2EZL9RulU9y
4TqEiYotPrCWuNqfQ5c4uyXjekZLtRNR+KyZQQsS/gMlPIDMhOSZA4O3GtyhdVML
yKCGKuPv6fpmUYlc0MBQgffYLHvhkQ81GShRuiA4cE9XzVb6KuI2oPsp2q2VHYsh
3oasixdl7NNSh7uj8dJG7e/kp4odChjSu8lwX8i2eb7rVlVhxOecPu8lh9gMBiOn
UZc0LjEMAJyCeX7IGLaMcX44wHJG0lmiDEt3BlzNExVAb0gelFjlRD5/u4QwS4If
q+/s9wAVTGTE1f58MStpUi73Jx7TXed1gVEmIwnCc9ynfohhKfRxeOLwcIiZqmie
4i66zEeSuOtEbuHJn7nZKCGjHBm7kJrURk5VWzpybMbCFiYUUqBW3DFtzgf/IiPv
RBloXGb5RlDYAZhVdeilsqrDTPsa29QeeflQLRfpFmv9sRLyeoo1kojYLzczi/KZ
N+8adAY+apH3vKfoj7b9Ts1UDAukjE4Nl0S0BGvwJEZQqfl5M8oJZg9YQ2n9MM7B
TQRdbptAARAAtw+Ib1ZBmXUgAbGWYivkJIEKXy0wNVizXBEtsJwpIrILSGE/xzPM
FVW9n0pUtTskEQyjujsHL/DEsUpiWYP2/j1O6bo7eR1rhQpOTqJq8HeCAoM1tw/D
+PEIfSnNyQgzSQnWPdvHkKFdtIwd826bu/DXQr5sX0B+fcAauShe5sZWeU5NCPVI
IDzqyXzjOF8lMvtSVJjQvVg7powovBH6pteyiANCcLysD6VhnnLbeXWsFOeAeQxj
Ej2LOuV2gFHnWNeVbMGlAeCfq2cISzVkfe/8BeEogY3SGPtSq70qN9ieU9SOqOKQ
EMiZ9kVUSQBUbeyffnvnhWmdcAeEfBNJejWpohgoCBpusdoYwx6hUOZXzrJ51d+V
jTdNXZ/nhAytJ8b/kpG/SYKZohJiKzGadD/5n+h4PsW+rmbkha5pQyHicXNovr8/
Gqb2NHe0tHNYUGUD/hSqeXdI0JYHETnBht4M1PdgeOyv9fNgxGSjHiKNWxYj9Z+Q
+0dfFNYFnmnyhf56ToBk9BURGwlwmh8EvE+rTgImHS+TaHzhJWxS7ktE9ZDycd0e
PGEji/g5yLYuotLGEcCO75BAHOuQT7+HuVU1IHkt5IWYyjj+xYnfYlYcWx6f6FAm
ooZ7EjnXvBsSlpf1IV8FNQw5rZRT7/N8esx0eCbgJDM4Ttc6QEvQfRUAEQEAAcLB
dgQYAQoAIBYhBEVynqE85ci10s8L2Nw8uCvwlnrwBQJdbptAAhsMAAoJENw8uCvw
lnrwI2kP+gKAxsiq4ohswg7p5TVUyhYFWSfcPBBnPL/SWgxrF5jEUmsYONXyuuZH
c3fLrJUdOfGW7Y2sJlAaDSLlr89mr1lgByXkJyBoiVAc+E/Jl9OOsqiSHkfYRVaQ
3T+ykbYQQSHH2xUhXpsiipgvmVw17z3zYIzZd8pJd2HTJd37W3HxuMPVli2JmWW1
6wQx1+ZhKblR43rQioWZ0yJh38x/v39tGX0y6PbgULEmNI20t8tsP43aDVjDh3sY
/3nUVbYpOzmGw0TYfTIujaYuIuh5SMHR5Ez6FWZ5qxin1E45sniXbtx40BvMUNXt
1G2flK3aUk4puDs5LFsFtit6GMw1/Te3XxqajkDLXnqpZw4EQewJoIvGoOW9sfPo
rXYEA+5MO4C4JXdx46VJgnhicOYnuIKxjFfBF1Cu/uvcCjxIuL9hKj32Gc+lJpkg
Cis9K7umxBmEVrQa4u8nO34HdVljdojtI7b6hODgJP1LtFLMzbtm23oVaxmePwUt
6k+FGhV4tx1SgnTNqR5E1Y0WIJxyp5C/yHH2+jR9+b5s9tHY+0lXXsEZXY5G0Df9
rkiRbTzBPpvjA+dsGpvLPwJ069rySVw5rD0hwmF3A9ykux6+eUFtqkse8cgntpcD
G8mwos1Mncujz3r8zg3eklE8ton7u7YEYgJIXd2oPSAdGwfIAVju
=PYzI
-----END PGP PUBLIC KEY BLOCK-----