Internal document · not for public distribution

Cyber Verification Program — Credibility Packet

A working self-assessment of hands-on security track record, built from real audit work across Code@'s live production portfolio — for use in Anthropic's CVP application and as a honest gut-check on going solo (no outside pentester hired) for the QiCard / Shift engagement.

Read this straight, not encouragingly: this page rates where things stand today, not where they could land with effort. A lower number now with a clear path up is more useful than a flattering one that falls apart under review.

01 — Eligibility Scorecard

38/100

Not yet — real skill, no public paper trail

The practitioner depth is genuinely strong. What's missing is anything a stranger (or an automated review system) can verify without taking your word for it — that's the entire gap between 38 and a confident approval.

Hands-on practitioner depth

80%

Breadth across sectors

75%

Named, scoped use case (QiCard)

40%

Public verifiable proof (CVE / talk / blog)

Formal certification

Bug bounty / disclosure reputation

02 — What Actually Backs This Up

Vulnerability classes personally found and remediated across live production systems, generalized here without naming which client's system each came from — the specifics stay private, the pattern doesn't.

70+

live production systems audited

distinct vulnerability classes fixed

of it publicly documented

▸ Broken access control

Case-insensitive edge routing bypassed an admin-panel auth gate — the hosting platform matched routes case-insensitively while the gate check was case-sensitive.
Parent/child route trust — an endpoint authorized against the parent resource ID in the URL but then acted on a separate, caller-supplied child ID with no re-check (classic IDOR shape).
Route-gating mistaken for data-gating — hiding a page behind a permission check left the underlying API still reachable directly.

▸ Injection & unsafe content handling

SVG upload XSS — a file-upload validator accepted anything matching image/*, which includes SVG's embeddable script content.

▸ Multi-tenant data exposure

Unauthenticated telemetry endpoint allowed cross-tenant reads and unbounded writes at once — a data leak and a storage-exhaustion DoS vector in the same bug.
Silent prop leakage — a documented, typed component prop was never actually implemented, but a rest-spread forwarded it anyway, leaking internal fields into the client bundle in a way that passed every type check.

▸ Rate limiting & resource abuse

Unnamespaced rate-limit key keyed on a client-controlled identifier — one bad actor could lock out an entire company, not just themselves.
Shared constant, divergent result — two code paths referenced the same rate value but produced different totals per tenant downstream; caught only by asserting the full computed output, not the shared constant.

▸ Secrets & config hygiene (go-live safety)

Mock defaults shipped live — five separate deployments had mock-OTP or localhost-API defaults reachable on their real production URLs.
Test suite against production — a DB test suite was found running destructive operations directly against a live database.
No E2E teardown — a test suite with no cleanup step left real financial state sitting in a staging environment for months, undetected.

▸ Platform / infra-level

Security headers skipped for a response class — an edge asset pipeline served certain dynamic responses before the header-injecting worker ever ran.
KDF cap silently failing on verify — an iteration count that succeeded on write silently failed on the read/verify path due to an undocumented platform ceiling.

03 — Methodology, Not Ad Hoc Poking

Audit type	What it checks
Internal security audit	Full-codebase vulnerability sweep, threat modeling, attack-path analysis, verified findings with severity + fix
Go-live readiness audit	Mock/dev defaults reachable in production, config drift between environments
API contract audit	Frontend assumptions verified against actual backend wire shape — not just "it compiles"
External / black-box audit	Same target treated as an outside attacker would, no source access assumed
Performance & accessibility audits	Adjacent black-box checks run on the same live-site methodology

04 — Path to a Real "Yes," Solo

Assuming no outside pentester is hired — capital, time, and dedication substitute for the credential, but only if spent on the right things in the right order.

Week 1–2

~$0–50 (domain/hosting)

Turn private findings into a public paper trail

Write 4–6 sanitized case studies from the list above as blog posts — pattern, impact, fix, no client names or exploitable specifics. Stand up a simple portfolio site linking them. Fill out the LinkedIn security section properly. This is the single highest-leverage move: it directly answers what the application form asks for.

Week 1–2

~$0

Get QiCard's engagement in writing

Signed rules-of-engagement: scope, environment, dates, out-of-scope systems, emergency contact, liability terms. Ask QiCard's security/legal team directly whether they require a specific certification or insurance from a pentest vendor — that answer matters more to this engagement than Anthropic's bar does, and should shape the rest of this roadmap.

Month 1–2

~$200–400

First public, third-party-verified credential

A practitioner-level cert doable in weeks, not months (eJPT-tier) — a real, checkable credential rather than a self-report.
Open a HackerOne or Bugcrowd profile and submit a handful of real findings, even low-severity ones. The point is a public reputation number, not the bounty payout.

Month 3–6

~$1,600–2,000 + study time

OSCP-tier credential + a real CVE

OSCP is the credential that carries weight both for Anthropic's review and for a fintech partner's own vendor risk checklist — it's the one worth the real time investment. In parallel, audit an open-source dependency already in the stack and responsibly disclose a real finding for an actual CVE assignment.

Ongoing

~$0

Compound it

Every future audit (with client sign-off) becomes another sanitized case study. The private track record already exists — this roadmap is entirely about making slices of it checkable by someone who isn't taking your word for it.

The part that isn't about Anthropic at all

CVP approval reportedly leans on a self-reported form and can come back in minutes — it may not be the real gate here. The real gate is whether QiCard's own security/legal/ compliance function is comfortable with an unaccredited solo tester probing their live systems, integration or not. That's a business conversation to have with QiCard directly, separate from and before the Anthropic application — an approved CVP account doesn't make QiCard's own sign-off requirements go away.