brett gervasoni principal security engineer, mx racer.

about

I am a security engineer at Salesforce. I have worked in the Offensive Security team in Product Security, and in the Enterprise Security team. I am also a passionate MX racer.

founded

tools

For the majority of the tools I write, I am unable to publicly release them as they are Salesforce owned. One particular suite of tools I wrote is being implemented into Salesforce itself. For others, I am in the process of seeking approval for their public release. In the event I can release them, I'll link them here. However, you can check out my Github for small personal tools I've written outside of work, such as BlueMove (a macOS Bluetooth device automatic switcher tool). I have also made contributions to the Apache Hertzbeat project.

public security advisories

To date, I have discovered high or critical risk security vulnerabilities in products from many well known vendors including Adobe, Cisco, Oracle, Foxit, Sun, HP, PHP, Novell, Symantec, Trend Micro, McAfee, and Microsoft. Majority of these were released through vulnerability disclosure programs such as the ZDI.

I have also participated bug bounty programs (including Google's), and have been credited with the discovery of multiple vulnerabilities.

The more recent vulnerabilities I have publicly reported through vulnerability disclosure programs, and at times opt to remain anonymous. A subset of the vulnerabilities I have discovered are listed below.