Andrei Dodu

I'm a security researcher and systems engineer in Sweden. I audit smart contracts and web applications as Dodu Security, I disclose vulnerabilities, and I build Hugin — an intercepting proxy and vulnerability scanner in a single Rust binary, local-first and built to leave no trace.

Most of my work lives at the intersection of two things: breaking web apps, and building the tooling to break them faster. Bug-bounty research keeps the methodology sharp; building Hugin keeps me honest about what tooling actually helps. The two feed each other.

For something concrete: I reported CVE-2026-28840, a local privilege-escalation flaw in macOS PackageKit that let an unprivileged app gain root (CVSS 7.8). Apple fixed it in macOS Tahoe 26.4.

On the engineering side I work primarily in Rust — for tooling and systems it's where I think software is heading, and it's what I build my own tools in. React is the exception, not the rule: I reach for it on a product like Redofy, not on my tooling. I care about fast, correct software — this site runs on a strict performance budget for the same reason.

Ethics & authorization

All offensive work I do is authorized and ethical: testing within agreed scope, responsible disclosure, and bug-bounty work inside program rules. No grey areas. It's the right way to work, and it's the only way enterprises should buy security testing.

From web apps to contracts

I spent years breaking web applications before I started reviewing contracts. The failure families are the same: a permission that was never checked, accounting that drifts between two components, a trust boundary that exists in the diagram but not in the code. The execution environment changes; the way you look for the bug does not.

That is the angle I bring to a protocol review. Solidity-specific bugs matter, but the expensive ones are usually the assumptions the team stopped noticing: who can call the function, what the oracle returns at the edge, and what happens when two contracts disagree about a balance.

How an engagement runs

Every engagement starts with a written scope: targets, commit hashes, what is out of bounds, the price and the dates. Findings arrive as they are confirmed instead of at the end, each with a proof of concept where it matters, and every accepted fix is verified by me before the report is final. See the engagements and fixed fees.

I do not audit code I am actively hunting, I do not test outside the agreed scope, and I do not publish a client's findings without written consent.