Bug bounty
Finding and responsibly disclosing vulnerabilities in production web applications and APIs.
Joshua Bullock
Development Lead · GhostKey Development
A security professional who also builds and ships software. Joshua leads development at GhostKey, bringing an attacker's eye from bug bounty and red-team work to everything the firm builds.
About Joshua Bullock
Joshua Bullock comes to development from the offensive side. Joshua finds and responsibly discloses vulnerabilities in production web applications and APIs, and runs adversary-minded tests of applications, infrastructure, and people-facing processes.
That background shapes how Joshua builds. Joshua's own projects put risky actions behind human approval gates, give every component least-privilege permissions, keep secrets server-side, and write an audit trail that holds up to review. The stack runs from Python and FastAPI to TypeScript, Next.js, and Cloudflare Workers, plus local LLMs with Ollama.
Full qualifications are at joshuabullock.com/quals.
Security
Red teaming
Adversary-minded testing of applications, infrastructure, and people-facing processes. How engagements work →
Information assurance
Protecting the confidentiality, integrity, and availability of sensitive data, with controls and audit trails that hold up to review.
Engineering stack
- Languages
- Python, TypeScript, JavaScript, SQL, HTML/CSS, Bash, PowerShell
- Front end
- React / Next.js, vanilla JS, responsive and mobile-first UI
- Back end
- FastAPI, Cloudflare Workers, REST APIs, scheduled jobs
- Data & cloud
- Cloudflare D1, R2, Queues, KV, Workers AI, Turnstile, Access
- AI
- Local LLMs with Ollama, multi-agent orchestration, tool use with human approval
- Security controls
- Human-in-the-loop approval gates, least-privilege permissions, audit logging, server-side secret custody, tenant and infrastructure isolation
- Shipping
- GitHub Actions CI, Windows and Linux installers, auto-update, pytest, custom audit tooling
Selected builds
SoggyWaffle
A crew of AI agents that runs entirely on your own computer using local Ollama models. A "chief of staff" bot takes each request and hands parts to other bots, which browse the web, research, handle email and files, and run scheduled tasks.
- Action gateway: anything risky (sending, submitting, clicking, running commands) waits for the user's approval and is written to an audit trail.
- Per-bot and per-group permissions for browser, files, email, terminal, and crew access.
- Live view of each bot's screen and reasoning; the bot hands the browser to the user for captchas and logins.
- One-click Windows and Linux installers built on GitHub Actions, with automatic in-app updates.
- 96 backend tests in pytest.
Lodestone Data
A data API and marketing site for an NWISI company, built to keep provider credentials server-side and keep a full compliance record of every search.
- Serverless API on Cloudflare Workers: auth, billing, batch processing, admin, and a grounded AI assistant.
- D1 (SQLite) as the audit ledger, R2 for batch files and reports, Queues for per-row batch jobs with retries.
- Infrastructure kept fully separate from the licensed agency: own repo, account, domain, and data store.
- 12-page static site from a dependency-free Python build, gated by a 1,090-check audit and a headless-browser pass.
Build with GhostKey
For development engagements, secure builds, or security testing, reach Joshua Bullock and the team through GhostKey Development.
[email protected]