Andrew Yong
Fog filling a valley of granite peaks, one ridge standing clear of it

I find the way in before anyone else does.

Penetration tester, 3+ years. Web apps, networks, cloud and mobile, tested by hand and written up so your team can fix it.

Email Andrew

What I test

  • A backlit keyboard in the dark

    Web apps and APIs

    Auth, access control and business logic.

  • Streaks of light in the dark, like signals down a cable

    Internal networks and AD

    One foothold to domain admin.

  • A suspension bridge running into cloud

    External and cloud

    Your internet edge, IAM and storage.

  • Someone checking a phone on a station platform

    Mobile

    Android, iOS and the APIs behind them.

  • A figure in a red coat scanning a snowy wood through binoculars

    OSINT

    What the internet already says about you.

How a test runs

  1. Fog lying in a wooded valley

    Scope

    Targets, dates and rules of engagement, agreed in writing.

  2. Forested slopes under drifting fog

    Recon

    Map what is exposed before touching any of it.

  3. A dark treeline fading into fog

    Exploit

    Every finding reproduced by hand before it is reported.

  4. A sea of cloud over hills at dawn

    Report

    Plain risk, steps to reproduce and a fix for each finding.

Cloud lying low over hills

Hiring for a security role?

Email me the role

Velocity

My open-source OSINT console: live aircraft, ships and satellites on one map.

Velocity's console over Europe: layers on the left, provenance on the right, the replay timeline along the bottom

The replay bar: scrub back to any moment in an archive on your own disk.

One aircraft selected in Velocity, with its identity and kinematics panel
One aircraft: who flies it, how high and how fast.
Velocity's provenance panel: contacts counted by the kind of source that saw them
Every contact says which kind of source saw it.
The Velocity app icon

Velocity is public on GitHub, with every test and the self-audit.

Read the case study Watch the repository

Need something tested?

Email me the scope

Common questions

Can you name past clients?

No. Engagements run under NDA, so client names and their findings stay private. What I can show is my method, my scope and the code I publish, including an audit of my own.

Are you open to a full-time role?

Yes. Email me the role, the team and what they test, and I’ll reply.

How do we start a test?

Email the scope, the dates and who I should talk to. I’ll come back with questions before anything is agreed.

What does the report look like?

Each finding gets its risk in plain words, the steps to reproduce it and the fix. The summary at the top is written for whoever signs off the budget.

Can I read your code?

Yes. Velocity is public under AGPL‑3.0 at github.com/AndrewCTF/velocity, with its tests and its security self-audit.

Fog lying over wooded hills at first light

Tell me what’s in scope.

A role or a test: one email reaches me.

andrew@andrewyong.dev

Email Andrew