[HERO_SECTION]

RYAN KOVATCH

Web Application Security Specialist

Hi! I'm a cybersecurity specialist with a focus on web application and API security. I recently graduated with an MS in Computer Science from the University of Oregon, where I did cryptographic protocol design and research. My accomplishments in bug bounty helped pay for my education.

public
[METRIC_01]

Google VRP

TOP 10%

payments
[METRIC_02]

Awards

$30K+

bug_report
[METRIC_03]

Critical Vulns

10+

01 //

VULNERABILITY RESEARCH

I’m proud to participate in the Google Bug Hunters Program, which has led the industry in supporting independent security researchers for many years.

Featured Writeup

Uploading a youtube video to anyone's channel

A logic bug in the YouTube Video Builder API allowed video uploads to any channel without owner authorization. Further investigation uncovered a bonus information leak. Read the writeup on Medium or the original report on Bug Hunters.

02 //

PROJECTS

CYBERSECURITY EDUCATION

UOregon Teaching SOC

The Teaching Security Operations Center (TSOC) at the University of Oregon immerses students in a real-world, fully operational SOC, where they rotate through critical roles and gain practical expertise in defending against today’s evolving cyber threats. Throughout grad school, I worked with the lead engineer to build out the TSOC’s internal infrastructure. They now enjoy a fully fleshed-out system of industry-standard security platforms and tools.

Endpoint Security Threat Intelligence Vulnerability Management Sysadmin
CRYPTOGRAPHY

Registration-Based Encryption for Internet Protocols

A new encryption scheme called registration-based encryption (RBE), developed within the last decade, allows for the binding of public keys to identities without certificates. This presents a new avenue for avoiding the traditional pitfalls of public-key infrastructure. My Master's thesis aimed to evaluate whether present RBE constructions could be applied to Internet protocols at scale. This included producing a proof-of-concept encrypted DNS protocol called ReDNS -- the first of its kind.

Cryptography Protocol Design Asymptotic Analysis
03 //

CONTACT

I'm always interested in new research opportunities, collaborations, or just talking shop. Looking forward to hearing from you.