Cody Zacharias

Owner and Security Consultant, Xen

Security research, consulting and software products

• Performed penetration tests for clients (web applications and APIs), both independently and in partnership with other security teams.
• Assisted clients with incident response: rapid post-incident patching, audits for related classes of issues, threat actor identification, and reports for law enforcement.
• Use AI daily across the research lifecycle: LLM-assisted source code analysis and vulnerability discovery, AI-assisted exploit and proof-of-concept development, and verification of findings.
• Choose models with refusal behavior in mind for legitimate offensive work, preferring GLM for security research, and build custom agent Skills and orchestrated pipelines for reproducible results.
• Built AI-assisted vulnerability analysis tooling, including for smart contract security (EVM).
• Mentored beginners in security and bug bounty hunting, and taught operational security for protecting accounts and digital assets.
• Built and shipped software products, including LaserSell.

Claude, GLM, Foundry, Burp Suite, custom tooling

Founder and Lead Developer, LaserSell

Non-custodial automated exit system for Solana

• Sole developer of a non-custodial automated exit system for Solana, written in Rust: a real-time stream processor (Yellowstone gRPC), a transaction-building API and a mainnet Anchor program behind a multisig upgrade authority. Also shipped a CLI, macOS app, web dashboard and SDKs in four languages.
• Designed for security: encrypted local keystore and client-side signing so keys never leave the user's device, and a Solana on-chain program that enforces fee revenue on-chain. Security audits were performed routinely by third parties, with findings triaged, remediated and documented internally.
• Published open-source benchmarks showing transaction builds 12–30× faster than alternatives.
• Ran the business end to end: built the websites, dashboards and platform, wrote the public documentation, did sales and marketing, and ran a Discord community with daily customer support. Development is currently paused.

Rust (Tokio, Axum), Anchor / Solana, Yellowstone gRPC, WebSocket, RocksDB, Redis, Next.js, Supabase, Docker, Vultr, Cloudflare, BetterStack

Security Engineer, Hyperproof

Contract position

• Owned application security testing for the company's SaaS platform, deciding what to test and where to focus without direction.
• Discovered security vulnerabilities through manual penetration testing with Burp Suite, alongside code review.
• Filed detailed bug reports in Jira and worked with engineers until findings were resolved.
• Worked in Azure cloud environments. Reviewed external penetration test reports and acted as the point of contact for a third-party assessment.
• Contributed to internal security documentation.

Founder and Security Researcher, SupplyShark

Supply chain security tooling for GitHub organizations

• Founded and ran a SaaS business that detected software supply chain vulnerabilities such as package hijacking and dependency confusion before attacks could occur, scanning thousands of repositories. Built the Python scanning engine and the customer platform end to end.
• Launched a free supply chain check to attract customers and ran outbound sales through cold email and LinkedIn outreach.
• Used the scanner to find vulnerabilities and reported them through bug bounty programs to Coinbase, Snapchat, MetaMask and several crypto companies.

Python, Next.js, Supabase

Product Security Analyst, HackerOne

Vulnerability triage and validation for customer bug bounty programs

• Validated incoming vulnerability reports, scored severity with CVSS and wrote impact assessments that customer security teams used to prioritize fixes.
• Led triage for several live hacking events: served as the main point of contact for the customer, delegated work across the triage team and kept the team current on procedures throughout.
• Learned customers' products and platforms in depth to reproduce and assess reports with Burp Suite, then trained other analysts on new programs.
• Built internal tools that streamlined triage, working extensively with AWS, Kubernetes and Docker, and contributed to a shared tool that saved the team time.
• Advised customer security engineers on remediation and kept communication between researchers and customers clear.
• Trained new hires and gave internal presentations.

Independent security researcher, Self-directed

• Focused on bug bounty hunting and exploit research, and built open-source security tools for security researchers, including Twint and subjack.