About me

I’m Dominic Couture, a principal security engineer at Clerk, a weekend bug bounty hunter, and someone who generally loves exploring rabbit holes. I started out as a software engineer and moved to security, and I still mostly work from the code: finding vulnerabilities, preventing them from reaching production, and making it easier for developers to write secure code. Now with AI all over this. When I’m not in front of a screen I’m usually in the forest or on top of a mountain somewhere with no phone reception.

Experience

Before Clerk I was at GitLab from 2019 to 2025 with Principal Security Engineer as my final role there. Previously I was a software engineer for 8 years.

I’ve also been doing bug bounty hunting on and off since 2019.

My LinkedIn profile has the details.

Vulnerabilities

I don’t care much about tracking personally, but nowadays we need a portfolio for cyber verification programs!

Some CVEs where I’m credited

CVE	Product	Issue
CVE-2026-109305	Craft CMS	Twig sandbox bypass leading to PHP callable invocation
CVE-2023-28755	Ruby (URI)	ReDoS in the URI parser
CVE-2021-43266	Mahara	Command injection in collection PDF export
CVE-2021-43265	Mahara	Cross-site scripting via tags
CVE-2021-43264	Mahara	Path traversal bypassing access control on help files
CVE-2021-37938	Kibana	Path traversal on Windows
CVE-2021-22140	Elastic App Search	XXE in the web crawler
CVE-2021-22139	Kibana	Denial of service through webhook actions
CVE-2021-22880	Rails (Active Record)	ReDoS in the PostgreSQL money type

There are many vulnerabilities I reported to private bug bounty programs where I wasn’t credited and I won’t disclose them here given the confidentiality agreement.

See also

• The disclosed reports on my HackerOne profile showing vulnerabilities without CVEs.
• Some now-public security-related issues from my time at GitLab
• The posts on this very blog

Public Tools

You can scour my GitLab and GitHub profiles for random things, but graphql-path-enum is probably the tool that got the most traction. It even got mentioned in a few talks and books!

I’m also a fan of notkeyhacks as a reference to save time.

Talks

• Fighting Fire with Fire: Using AI to Scale Your Product Security Team — BSides Dublin 2026 (slides)
• An Ode to Rabbit Holes: Writing a New Decompiler Just for a Security Audit — HITBSecConf Phuket 2023 (video)
• Bug Bounty? Great! Now What? (panel) — Nullcon Berlin 2022 (video)
• Elastic Disclosure — Finding and Reporting Security Bugs to Elastic (lightning talk) — ElasticCC 2021 (video)