Software and security engineer in Rosario, Argentina
Santiago Passafiume
Penetration testing, security reviews and secure development for web applications, APIs and AWS. I report what is exploitable and how to fix it.
What I do
Services
I deliver every security engagement personally, from scoping to the final report.
Security testing
Find what an attacker could exploit.
-
Web and API penetration testing
Manual testing of web applications and APIs, the way an attacker would approach them.
-
Cloud penetration testing (AWS)
Testing and configuration review of AWS environments: permissions, exposure and secrets.
-
Vulnerability assessment
A broad review of your exposure, with risks ranked so you know what to fix first.
-
Mobile penetration testing
Security testing of Android and iOS apps and the APIs behind them.
Advisory and training
Build security into how your team designs and writes software.
-
Secure code review
A review of your code to find vulnerabilities before they reach production.
-
Architecture review
Threat modeling and design review, before the decisions are expensive to change.
-
DevSecOps
Security built into your development process: pipelines, dependencies and secrets.
-
Security training
Hands-on secure development workshops for engineering teams.
Process
How I work
-
Scope and authorization
We define what to test, how and when. Nothing starts without your written authorization.
-
Testing
Manual testing and review, supported by tools. If I find something critical, I tell you right away.
-
Report
You get every finding rated with CVSS v4.0, with the steps to reproduce it and the recommended fix.
-
Follow-up
I walk your team through the results and re-test the fixes at no extra cost, if you request it within 90 days of the report.
Experience
Background
I started in security as a penetration tester for a US consulting firm. I then joined Ualá as an application security engineer, doing design reviews, penetration testing and vulnerability management.
Today I build backend services in Go on AWS at Ualá, with authentication, encryption and traceability built to payments-industry requirements. I also co-founded RyuLabs, a web and software development studio.
I've tested, defended and built production systems, so the fixes I recommend are ones your team can ship.
Ground rules
What I don't do
Every engagement follows these rules.
- I don't test any system without written authorization from its owner.
- I don't run denial-of-service tests or destructive actions on production unless agreed in writing.
- I don't promise a system is 100% secure: a test shows the risks found within a defined scope and timeframe.
- I don't share findings or client names without permission.
Before you start
Frequently asked questions
How much does it cost?
Every engagement is quoted individually, based on the scope. After a first conversation I send you a proposal with the scope, the timeline and the price.
How long does it take?
It depends on the scope. The timeline is agreed in the proposal, before starting.
Do you sign an NDA?
Yes. If you need one, we sign it before you share any information.
What methodology do you follow?
I follow the OWASP Web Security Testing Guide (WSTG v4.2), cover the risks in the OWASP API Security Top 10 (2023) and verify against the OWASP ASVS 5.0. Testing is manual, supported by tools, and every finding is rated with CVSS v4.0.
How do you handle our data?
Evidence and any data I access are stored encrypted, used only for the engagement and securely deleted when it ends (after the re-test, if there is one), unless we agree otherwise in writing. Reports are shared through an encrypted channel, and I recommend rotating any credentials you gave me once testing is over.
Is a re-test included?
Yes. In penetration tests, I re-test the fixed findings at no extra cost to confirm they're resolved. Request it within 90 days of receiving the report; after that, it's quoted separately.
Do you work with companies outside Argentina?
Yes. I work remotely with companies in Argentina and abroad, in English or Spanish.
Is it legal to test my system?
Yes, when the owner of the system authorizes it in writing and the scope is defined. That is how every engagement starts.
Do you take on development projects?
Backend and other development projects are delivered through RyuLabs, the studio I co-founded, which gives you a full team behind the project.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.