SARICITAL, Dario Šarić

Every system has a way in.

For the people it was built to serve.

Sometimes for someone it wasn’t.

Every layer decides who to trust.

  • Identity
  • Session
  • Access
  • Data
  • Audit
  • Infrastructure

An attacker needs only one open path.

I look for that path first.

I trace it to the rule that failed.

Then close it where it begins.

The same thinking shapes what I build.

Security. Software. Business logic. One system.

We don’t escape the matrix.

We debug it.

Record

  1. HackerOne #15 worldwide, 2026 · San Francisco, USA
  2. #30 all-time, GHSA credit · 2026 · Seattle, USA
  3. HackerOne research · 2026 · San Francisco, USA
  4. HackerOne research · 2026 · New York, USA
  5. HackerOne research · 2026 · Panama City, Panama
  6. HackerOne research · 2026 · Tel Aviv, Israel
  7. Succinct LabsCantina #20 · smart-contract competition, 2025 · San Francisco, USA
  8. Lion Aircustom Vorkasse e-commerce, 2022 · Igis, Switzerland
  9. Digital ecosystem · B2B and beyond · Derventa, Bosnia and Herzegovina

Dario Šarić

SARICITAL, Dario Šarić
SARICITAL, Dario Šarić
Menu

Dario Šarić

Security researcher & cloud infrastructure engineer

About

Under the name SARICITAL, I work on both sides of a system: I find the paths it should never allow, and I build the software and cloud infrastructure that must hold when assumptions fail.

In 2026 my HackerOne research covers Cloudflare, AWS, GitHub, MongoDB, Copa Airlines and Wix. I report vulnerabilities responsibly and bring what I learn back into the systems I design.

I rank #15 worldwide on Cloudflare’s program and #30 all-time on AWS, with a GitHub Security Advisory (GHSA) credit. In 2025 I also placed 20th in a Cantina smart-contract vulnerability competition for Succinct Labs.

Research

Security research and results
ProgramPlatformResultYearBased in
CloudflareHackerOne#15 worldwide2026San Francisco, USA
AWSHackerOne#30 all-time, GitHub Security Advisory (GHSA) credit2026Seattle, USA
GitHubHackerOneVulnerability research, responsible disclosure2026San Francisco, USA
MongoDBHackerOneVulnerability research, responsible disclosure2026New York, USA
Copa AirlinesHackerOneVulnerability research, responsible disclosure2026Panama City, Panama
WixHackerOneVulnerability research, responsible disclosure2026Tel Aviv, Israel
Succinct LabsCantina20th place, smart-contract vulnerability competition2025San Francisco, USA

Work

  • Fidelio A — Hotel Biser2026

    Fidelio A brings Hotel Biser’s operations into one system. Its AI understands written and spoken guest requests across languages and routes each one to the right department and staff member. Every task moves from receipt to resolution through clear statuses, with deadlines tracked in real time. Every action leaves an immutable record; the system detects inconsistencies and attempts to manipulate the process in a fraction of a second. One hotel. One system. Full control.

    Watch the film

  • Fructa Trade — digital ecosystem

    For Fructa Trade in Derventa, we are building a complete digital ecosystem. The B2B portal is one part of it: connected solutions for the company’s work, designed so its processes, business rules and security operate as one system.

    Watch the film

  • Lion Air web shop2022

    A web shop for Lion Air’s air purifiers in Igis, Switzerland. Its custom Vorkasse checkout makes prepayment part of the purchase flow, with the customer journey and business rules designed together.

    lionair.ch · Watch the film

  • Grapestore2022

    A digital showcase for Grape Store’s solar-powered smart benches. The site connects the physical products with their digital features — Wi-Fi, charging, sensors and a cloud dashboard — and gives visitors a clear way to explore the range.

    grapestore.ch

  • Web3 smart-contract audits2025

    Smart-contract audit competitions for Panoptic Vault, Telcoin Association, Jigsaw Protocol and Succinct Network. I trace what each contract allows, what it assumes and where those assumptions could break.

Approach

I start with one legitimate action. Who may perform it? Which state may it change? What if the request is forged, repeated, reordered or skipped?

I follow the answer across identity, session, permissions, data and audit. When a shortcut appears, I put the rule at the boundary it crosses: reject the action, record the attempt and keep the system consistent.

That is how I build. The visible interaction stays simple because the hard decisions have already been made beneath it. Security, development and business logic form one design.

Contact

© 2026 Dario Šarić · SARICITAL