xaccefyupdated September 2026

Khaserdene

Security Researcher & Developer

At MUST (expected 2028), working on vulnerability research, software development, and systems design & engineering. Learning by doing: CTFs, writeups, and small open-source contributions, including two responsible disclosures fixed upstream.

Cybersecurity student · Ulaanbaatar, Mongolia · open to security and vulnerability research work

résumé ENrésumé MNemail me

FINDINGS

CVE-2026-33151
Socket.IO: memory exhaustion via unbounded binary attachments, found by fuzzing [high] [2026]
CVE-2026-33245
React Router: XSS in unstable RSC redirect handling via javascript: targets [high] [2026]

EXPERIENCE

2026
Security Software Engineer · Ember Grand · built an early PTaaS prototype to automate parts of offensive workflows; integrated a RAG flow to support analysis and draft reports
2025 – now
Freelance Developer · delivered a mobile app and a web app for clients end to end: requirements, implementation, deployment

ACHIEVEMENTS

1st
Banksec x Mazala live hacking[2026]
2nd
cell broadcast integration @UB Hackathon 2026, team CCS[2026]
2nd
persistent SOC agents @SICT Olympiad 2026[2026][paper]
4th
VeriTransit Challenge 2026 final, with team HACKRATIC[2026]
7th
AITU CTF 2026 final, with team HACKRATIC[2026]
8th overall
Haruuli Zangi 2026 finalist with team HACKRATIC[2026]
Award
Khan Bank Scholarship[2025]

PROJECTS

pi-xpi
pentest tools for Pi Agent: casefile, web search, exploit lookup, code intel [author]
ratic
cleaner Claude Code fork for engineering and security [core maintainer]
casefile
bug bounty casefile: targets, notes, evidence in one place [author] [archived]
learnmax
full learning loop for coding agents: learn, quiz, spaced repetition [author]
sweep
lazy senior-dev mode for Pi: stdlib before custom code, one line before fifty [author]
archdot
Arch + Hyprland setup for daily security work [author]

WRITING

htb
HackTheBox writeups · seasons and fortress boxes
pwn
ROP Emporium solutions · every challenge, with short notes
ctf
CTFMN solutions · local CTF walkthroughs

STACK

security
binary exploitation · reversing · vuln research · disclosure · CTF
agents
agentic development · MCP servers · Pi extensions · RAG workflows
systems
architecture · system design · distributed systems (learning)
languages
Python · C · Bash · JavaScript · Go · Rust
tools
pwntools · pwndbg · GDB · Ghidra · Caido · MCP servers · Git
platforms
Linux · Docker · networking · cloud basics

EDUCATION

2028
Mongolian University of Science and Technology · Information and Communication Technology, Security focus · Expected Jun 2028 · GPA 3.35 · Ulaanbaatar

ACTIVELY LEARNING

now
distributed systems · rust

CONTACT

email: xaccefy@gmail.com · github · x · hackratic · htb